AeroFTP: baixar versions anteriors

[4.2.4] - 2026-10-20
Native Proton Drive, Headless Profiles, and Bulk Transfers
Proton Drive gains a native client with browser sign-in, encrypted vault sessions, verified transfers and storage quota. Saved profiles can be created and authorized from the GUI, CLI and MCP with the same connection options. Proton CLI compatibility mode groups suitable files into bounded bulk transfers across the CLI, GUI and compatible sync operations. This release also strengthens interrupted transfers, recursive operations, profile backups and archive extraction, and repairs desktop packaging and integration issues.
The complete record of this cycle, including fixes, validation and remaining follow-ups, is in the 4.2.4 release tracker.
Added
- Native Proton Drive. Connect through AeroFTP's own client with browser sign-in, encrypted vault sessions, file and folder operations, revisions, verified downloads, checksums and quota. New profiles choose native mode when available; existing profiles keep official CLI mode until explicitly changed. Small transfers use a single request, large transfers overlap blocks, and revision pages are prefetched (#1293, #1302).
- Bulk transfers in Proton CLI mode. Suitable files share bounded native invocations across the CLI, GUI and compatible sync operations, retaining per-file outcomes, cancellation and verified download publication. Existing resume, delta, checksum and error-correction requirements keep their established paths. MEGAcmd and Filen bulk remain unsupported; remaining wrapper performance work stays open in the release tracker (Requested 71, #1317).
- Headless profile authorization. CLI and MCP can authorize saved profiles through supported OAuth, GitHub Device Flow and GitHub App flows, refresh expired App sessions, and consume supported structured credentials without storing unused seeds. Pending authorization stays encrypted and bound to the intended profile and user (#1305).
- One connection manifest for GUI, CLI and MCP. Profile creation shares aliases, presets, defaults and public options, preserving existing FTP modes and explicit native/CLI Proton choices (#1304). profile-add --proton-mode and proton sign-in, sign-out and status make native Proton profiles usable headlessly (#1296).
- Saved SITE templates. FTP and FTPS profiles can keep commands with text, number and secret slots and run them from the GUI, CLI and TUI. Secret slot values are never saved, and importing the glFTPd catalog preserves existing template names (@jnewing, #1109).
- AeroCloud from saved profiles. Choose a saved connection and the folder under it from a searchable list. Saved S3, B2, Azure, kDrive and OAuth profiles connect through the same profile loading path as the rest of the app (#1231).
- Incremental AeroCloud changes. Local watcher events sync the paths that changed rather than rescanning the remote tree. Providers can require a minimum interval between full scans, and unchanged KeepBoth conflicts no longer create a new conflict copy every cycle (#1283).
- Windows association choices. Setup and Settings independently control AeroFTP format associations and archive/Explorer integration. NSIS /NOASSOC and MSI feature maintenance preserve disabled choices and other applications' registrations (@pasha-zzz, #454, #1209).
- Linux tray and account details. Theme-aware tray icons, sync actions that follow AeroCloud state, saved-profile counts in the account chooser, collapsible AI model groups and a visible controller bar (#1210).
Fixed
- Cross-profile copies reuse saved sign-in and encryption settings. CLI, GUI and agent copies open profiles through their shared authentication path, keep overlay data encrypted on the remote, preserve empty directories and skip equal-size files whose destination is not older. A missing or unreadable source subtree fails the plan instead of reporting an incomplete copy as successful; setup errors and partially failed batches close the activity with the correct outcome. Profile credentia

[4.2.3] - 2026-10-13
Checked Writes, Resumable Ranges, and SITE Commands
A repair release, one week after 4.2.2: 122 commits and 86 tracked changes. The thread running through it is data you could lose when something goes wrong half way. An operation that checks whether a file exists before writing now writes only when the server confirmed it is not there, a WebDAV replace keeps the old file until the new one is in place, crypt init writes nothing until the Emergency Kit is in your hands, and a large download that loses a connection resumes the range it was reading instead of starting over. Around that: SITE commands for FTP and FTPS, a local folder usable wherever the CLI takes a URL, a transfer speed that shows the current speed, and AeroAgent 1.7, which can drive the visible app when you ask it to.
Every change listed here is tracked, with its commit and its discussion, in the release tracker: AeroFTP 4.2.3, known issues, patches and updates.
Thank you to everyone who uses AeroFTP, at home or at work, and especially to those who write back when something does not behave. A large part of this release started from a report: benchmark runs from Western Europe that showed MEGA and Proton transfers with no progress, a request for raw SITE commands, a crash report about large uploads that led to the progress and speed rework, and two interface proposals now in the app. The people behind them are listed at the end.
Before the tag, an independent pre-release review read how this cycle's changes fit together on main, in three areas: writes that can lose data, the transfer engine and its retries, and the security surface, the latter checked against the security advisories rclone published on October 9. A second pass read the fixes that landed after it. Together they found three blockers, all fixed below before the tag; the non-blocking findings are recorded in the tracker.
What changes for you
The short version, split by where you meet it. Everything in this list appears again further down with the detail.
In the app
- A failed check no longer leads to a write. Creating a crypt vault, unlocking AeroCrypt, touching a file, and uploading with no-clobber, immutable or "skip existing" write only when the server answered that the item is not there. If the check itself fails (timeout, permission, server error), the operation stops instead of writing over what might be there.
- Replacing a file on WebDAV keeps the old one until the new one is in place. Apache, rclone serve and Nextcloud start an overwriting MOVE by deleting the destination, so a failure in between lost the file. The old file is now set aside, the new one moved in, and only then the old one deleted.
- Large downloads survive a stalled read. When one range of a segmented download stalls or loses its connection, that range resumes from where it stopped instead of the whole file starting again, on SFTP, FTP, S3 and every HTTP provider with ranged reads.
- The speed you see is the current one. Speed, graph and time remaining follow the last 3 seconds instead of the average since the start, the graph covers the whole transfer and keeps a stall as a dip, and progress moves while the file is being sent on S3, Azure, Dropbox, Box, Google Drive, B2, Swift, Jottacloud, Internxt, OpenDrive, MEGA and Proton.
- SITE commands for FTP and FTPS, from a new Connection menu, sent through the connection already open.
- Resizable Local and Remote panels, and a day and night appearance on a schedule. Drag or use the keyboard on the divider, and the split is kept across restarts. Appearance can follow the system or switch at the times you set.
- AeroAgent 1.7. It can operate the visible app when you ask it to (select, navigate, connect a saved profile, change settings), each step approved, with a cursor on screen and a badge to slow it down, pause or stop it. It also runs the community benchmark inside the app, gains the remote tools the MCP server already had, works with Anthropic again, and sho

[4.2.2] - 2026-10-05
MCP Servers for AeroAgent, Faster SFTP, and Parallel Selections
A patch release with two things you will notice at once. AeroAgent reaches 1.6: it can now use the tools of MCP servers, local or remote, each call approved in its own window, it can hand read-only work to scoped workers, and Amazon Bedrock joins its providers. SFTP got much faster: uploads move twice the data at a time, downloads keep the server busy, and both use less memory. Selecting several files now transfers them in parallel on every protocol. Around those, providers gained the actions their services offer (S3 storage classes and Glacier restore, Azure access tiers, Box and Google Drive comments, GitLab links, Filen note tags), folder renames work on B2 and ImageKit, and a long sweep removed more than a hundred backend commands nothing called, among them one that handed a decrypted credential to the interface.
Every change listed here is tracked, with its commit and its discussion, in the release tracker: AeroFTP 4.2.2, known issues, patches and updates.
Thank you to everyone who uses AeroFTP and tells us what works and what does not: several of the changes below exist because someone took the time to report them, and the people who shaped this release by name are listed at the end.
What changes for you
The short version, split by where you meet it. Everything in this list appears again further down with the detail and the commit.
In the app
- AeroAgent 1.6 can use MCP servers. In AI Settings > MCP you add local servers (started in a sandbox, Linux only for now) and remote ones over HTTP, with a bearer token or a browser sign-in whose secrets stay in the backend. AeroAgent sees the tools of the servers you enable, and every call is checked again and approved once in the approval window, never remembered for the chat. A Recommended servers section starts with DeepWiki, and a local server can be given read-only access to folders you pick and confirm.
- AeroAgent can delegate read-only work, and talks to Amazon Bedrock. Up to two scoped workers run side by side on local folders or on pinned S3 profiles, within one shared budget, and Stop cancels them with the chat. Amazon Bedrock is a new provider, with region and model settings.
- SFTP is much faster. A single upload now sends whole write requests, so twice as much data is in flight: 300 MiB over a 47 ms link went from about 20 s to about 10.6 s. Downloads ask for one read per chunk, so the server never idles between rounds (about 46-52 s down to 34-39 s on one connection, 22-27 s to 17-24 s on four), small packets no longer wait for an acknowledgement (one connection on a faster line: 33-35 s down to 17-18 s), and a segmented download shares one memory budget across its connections (25 to 33 MB less at the peak).
- Large trees are read several folders at a time. Calculating used storage, and every walk of a WebDAV tree (AeroSync Compare among them), lists up to eight folders at once instead of one after another: on a WebDAV server with 875 folders and 60,800 files the used-storage scan went from 42-52 s to under 7 s, and on SFTP a tree of 834 folders from 160-180 s to 23 s, with the same figure.
- Selecting several files transfers them in parallel, on every protocol. A multi-file selection used to go one file at a time; it is now one parallel batch, the first Stop lets the files in flight finish, and a cut deletes only the sources that arrived. Parallel transfers also no longer get pinned to one file at a time on a server after a few batches.
- Segmented downloads show real progress, stop when asked, and never publish another download's file. Progress, speed and ETA move while the ranges run, Stop interrupts a large download at once, and two downloads of the same file can no longer leave the second one's empty, pre-sized file in place.
- Provider actions from the context menu. S3 objects get Storage Class, Object Tags and Restore from Glacier; Azure blobs get Access Tier; Box and Google 

[4.2.1] - 2026-09-30
Four New Ways to Connect, and a Round of Repairs
A patch release that also brings new places to connect: Twake Drive as a native integration, IBM Cloud Object Storage and Mail.ru Cloud as ready presets, and Proton Drive through the official Proton Drive CLI. AeroAgent reaches 1.5, with provider-native reasoning kept across tool calls and approvals that fail closed. Most of the rest is repair: extraction, trash, keystore backups, sync, the CLI and the cloud providers now do what they say, and several of the fixes came from community reports. A full pre-release review read every change since 4.2.0; the defects it found, among them a Mirror that could delete files it had been told to keep and a keystore import that could drop servers, are all fixed here, each with a test that failed before the fix.
Every change listed here is tracked, with its commit and its discussion, in the release tracker: AeroFTP 4.2.1, known issues, patches and updates.
What changes for you
Most of this release is new places to connect and repair, so the short version below is split by where you meet it: what is new, and what stops going wrong. Everything in this list appears again further down with the detail and the commit.
In the app
- Four new ways to connect: Twake Drive, IBM Cloud Object Storage, Mail.ru Cloud and Proton Drive. Twake Drive (formerly Cozy Cloud, 5 GB free) is a native provider that signs in against your own instance in the browser, with no vendor app. IBM Cloud Object Storage and Mail.ru Cloud join as ready presets with setup pages on the docs site. Proton Drive works through the official Proton Drive CLI: sign in to Proton in the browser and AeroFTP drives it, with a live check that says whether the CLI is installed and signed in.
- A failed extraction no longer empties or shortens files you already had. A wrong 7z password could replace an existing file with an empty one, and a truncated zip, tar or 7z extracted short files silently. Entries are now written aside and moved into place only when complete, and a wrong password is named as such.
- A Mirror keeps what it did not complete, and removing a folder never takes its content along. A file the sync was told to leave alone, or one whose backup copy failed, keeps its folder, and the result says why each folder was kept. Deleting a folder without asking for recursion now refuses one that still holds files, on every backend.
- AeroSync's versioned backup keeps the old copy on remote destinations too. Before a sync overwrites or deletes a file on a remote, the old copy is moved to the backup folder, and a later Mirror can never delete those copies. The Plan also gains exclude patterns for every pair and shows the matching command-line sync for the same run.
- Importing a keystore backup shows, server by server, what would change, and lets you choose. New, removed and changed profiles are listed with their field-level differences (never a secret), and a changed profile can take the backup's version, keep this device's, or be kept as both. A "skip existing" import no longer drops the servers you added after the backup.
- AeroAgent asks for approvals in its own window, and remembers an answer for the rest of the chat. Only that window can grant an approval; allowing a tool for the rest of the chat (off by default, never for delete, trash, shell or extraction) means three folders need one approval instead of three. Stop now also cancels the tools still running, and on a large vault the agent sees every saved server instead of the first fifth.
- SFTP transfers no longer hang when the server goes away. An upload in flight when the server restarted used to never return; every SFTP transfer now ends as a lost connection that the app reconnects on and the command line retries.
- Cloud providers no longer act on an item whose name differs only in case. On Google Drive, uploading a.txt beside A.txt overwrote A.txt; similar traps on Box, kDrive, Drime, Internxt and OneDrive ar

[4.2.0] - 2026-09-21
Measured Against rclone, Read Commit by Commit
A cycle of tuning and repair rather than of features, and the longest since the project started: 161 tracked changes over 165 commits in three weeks, most of them fixes and many of them found by measuring rather than by reading. The transfer engine went through a live review battery against rclone on the same links, payloads and servers, and every gap it found (a speed limit most providers ignored, one-way sync re-uploading unchanged trees, a new SSH handshake for every SFTP file, serial scans and serial reads) was closed and measured again, so the DAG engine's performance is confirmed rather than assumed. Filebase joins as a production-ready S3 preset, S3 learns delta uploads, and AeroCrypt reaches its base goal on Linux and, above all, on Windows, where the Rust test suite now runs for the first time and a key-authenticated delta finally transfers only the changed bytes.
Every commit of the cycle was read by several independent reviewers, and the finding they returned most often had one shape: an answer that looked complete while part of the work had not been seen. That is why so many entries below are about scans, deletes and exit codes that now say what they did not cover, and it is also why the last work of the cycle went into the download path: a file assembled from several streams could be handed back built out of two different versions of the same object, with the right length and nothing to signal it, and the defect was reproduced on a live server before it was fixed. Nothing here is claimed that was not measured or pinned by a test, and where something is still open it is written down rather than left out.
Every change listed here is tracked, with its commit and its discussion, in the release tracker: AeroFTP 4.2.0, known issues, patches and updates.
What changes for you
Most of this release is repair, so the clearest way to read it is by what stops going wrong. The list below is the short version for people who use AeroFTP rather than read its code; everything in it appears again further down with the detail and the commit.
In the app
- The comparison panel says how much is really out of sync. AeroSync Compare divided by the rows it lists, and it never lists identical files, so any two folders with a single difference read as 100% out of sync. It now divides by everything the scan examined: two folders that differ by one file out of two read as 50%, by count and by size, on local folders and against every remote and encrypted connection. A path that is a file on one side and a folder on the other is counted as the difference it is, instead of disappearing into the identical total.
- Large downloads are faster, and they check what they hand you. A download above 250 MiB now runs on several connections by default, on numbers measured per protocol: 8 on SFTP, WebDAV and FTP, 4 on S3. That part is new in this release, and so is the check that goes with it: if the file changes on the server while it is being read, the download refuses to publish the result and reads it again on one connection instead of handing you a file built out of two versions.
- A one-way mirror does not delete what it never synced. In receive-only, a local-only file used to be skipped on the first cycle and deleted on the second; in send-only the same happened to a file another person added to a shared folder. Both are fixed, and more broadly a sync that could not read part of a tree no longer deletes, downloads or uploads anything under the part it could not see.
- Interrupted work resumes instead of starting over. The sync journal survives a run that ends with failed files, so Resume is still offered, and resuming transfers the files that had not been reached rather than repeating the ones that had.
- Cancelling a large upload no longer leaves pieces behind on the server, and "Remove application data" in the Windows uninstaller now does what it says.
- A 1 GiB upload peaks at abo

[4.1.9] - 2026-09-01
The Release That Stopped Believing Its Own Gates
Three CI lanes in this repository could report success having executed no tests at all, and one of them had been doing exactly that since May. A pull request said two review findings were closed by two tests, and one of those tests had never run in any run, because an attribute had landed between another test's #[test] and its function; the suite reported the same passing count either way. Six error-classification rules had never fired once, because the codes they look for are followed by a bracket and not a space. The pattern under all of it is the same: a green result that was measuring nothing, and no way to tell it apart from a green result that was measuring everything. What is fixed here is not only the individual defects but the instruments, so that the next time one of them is empty it says so.
Alongside that, FTP stops hanging on a refusal the server already sent, WebDAV survives a rotated Digest nonce on every path rather than five of them, Swift and Blomp accounts list their files again, and a private OpenStack that legitimately serves cleartext can now say so instead of being refused.
Added
- AeroSync preserves POSIX.1e access ACLs on Linux, opt-in, alongside the integrated protocol and metadata gaps closed in the same change. Owner, group and device files remain out of scope and are still listed as such.
- The language chip in the status bar is a way in, not only a readout. It opens Settings on the Interface sub-tab, where the language list actually lives, so the shortest path from noticing the language to changing it stops going through two panels. Its accessible name says what the button does rather than only what it reads.
- A private OpenStack that legitimately serves cleartext can say so. The guard that refuses an unencrypted object store after an encrypted login stays on by default; a profile can now opt in explicitly, which is what the Blomp preset does, instead of the guard being off for everyone.
- The app chrome can be restyled through published CSS tokens rather than through arbitrary user CSS. The tokens are a contract with names that stay stable, so a theme does not break on the next release the way a selector-based override would.
- The resume store has a screen, so the multipart checkpoint cap has an escape in the GUI and not only in aeroftp checkpoints.
- Quick Connect reaches a private OpenStack, and the Blomp tile carries its own identity rather than a generic Swift one.
Fixed
- Swift and Blomp accounts list their files again. The GUI opens a session on ., which Swift turned into the prefix ./, and that matches no object: the server answered 200 with an empty array, so every account looked empty in the app with no error at all, while the CLI, which sends /, worked.
- An FTP download of a file that is not there no longer waits for ever with the refusal already in the client. The wait was inside the data channel's TLS handshake, one step before the read loop that was already guarded, so a request the server accepted and then ignored had no deadline at all. Every data-channel opening now has one, listings have their own, and an expiry drops the session instead of handing the next command a reply that is still owed.
- A transfer the server closed was abandoned without a single retry, and reported as a disk error. Two wrong answers at once: the user was told their disk had failed, and the transfer that would have succeeded on the second attempt was not attempted.
- Six FTP classification rules had never fired once. They look for a status code followed by a space, while every failure this application renders puts a ] there. Quota, permission, not-found and authentication were decided by rules that could not see the shape the system produces, so a permanent refusal was retried three times. They were not uniformly dead, which is worse: a server that echoes its own code inside the message made the old rule match by accident, so the clas

[4.1.8] - 2026-08-26
The Release That Audited Itself
Four independent adversarial audits ran over the 111 commits behind this release, then two independent merges of those four reports were reconciled against each other. They found a checkbox that handed a private key to every account on the machine, a security guard silently removed for every OpenStack account while the provider it was meant for shipped as stable over cleartext, a discovery feature that had never once reached the network, and a release script that executed the file it documents itself as only inspecting. Every one of them is fixed here. The useful lesson is not the count: only two defects were found by all four auditors, thirteen by exactly one, and three auditors cleared kDrive discovery by reading the provider function when the defect was in its caller. Alongside that, Quick Connect learns to discover buckets and drives, rclone export covers Zoho WorkDrive and crypt overlays, and the resume-record store finally stops growing forever. 47 languages, with 47 strings this release had shipped with their diacritics stripped put back, 28 mangled Icelandic strings retranslated, and 187 banned dash characters removed with the validator now rejecting them.
Added
- Quick Connect discovers your S3 and Backblaze buckets and your kDrive drives, instead of asking you to type a name you may not remember. Manual entry stays. Quota fields take numeric units, OAuth shows the real callback URL, and the Crypt scope text says what it actually scopes (#369).
- Export to rclone.conf covers Zoho WorkDrive and rclone-crypt overlays. Zoho was gated shut by a test claiming rclone had no zoho backend; it has had one for years. A crypt overlay emits a sibling type = crypt remote whose remote = <base>:<path> is the Overlays Path (@EhudKirsh, #347).
- Text files open in preview rather than an invisible editor tab, Filen reports the storage held by retained versions, and Properties makes read-only and hidden editable where they are real attributes (@EhudKirsh, #347).
- Add Service form tabs can be dragged to reorder, with the same inherit-slot drop My Servers uses, and the typed fields stay with their tab (@EhudKirsh, #347).
- aeroftp checkpoints lists and forgets multipart resume records. The store documented an escape for a decommissioned server that nothing could call; the listing is what makes it usable, since forgetting matches four exact strings nobody could otherwise supply.
- CLI, GUI and MCP parity is measurable: inventory now sees the Tauri command surface and diffs it against the other two.
Changed
- Error correction is abbreviated EC everywhere, and ECC is left to mean Elliptic Curve Cryptography. 26 bare occurrences renamed; task ids, on-disk directories and the wire-format field keep their spelling, and the notes now say why (@EhudKirsh, #347).
Fixed
- Ticking read-only on a symbolic link changed the permissions of the file it pointed at. The mode was read without following the link and written with a call that does follow, and a Linux symlink always reports 0777, so a convenience link to a private 0600 key wrote 0577 onto the key and handed it to every other account on the machine. Un-ticking wrote 0777. The dialog then reported the file as still writable, so there was no sign anything had happened.
- Swift and OpenStack accounts no longer send your access token in the clear without telling you. A guard that refused a cleartext object store after an encrypted login had been removed for every account, while Blomp was promoted to the production grid in the same release. Blomp still works, because the provider preset declares that its storage offers no encryption, not because the guard is off.
- Quick Connect "Discover drives" works for kDrive. It had never worked: the shared placeholder is rejected by the numeric drive-id check, so every click failed before a single request left the app.
- Folder downloads over WebDAV honour the concurrent-transfers setting instead of running 

[4.1.7] - 2026-08-08
Summer Release: AeroRsync Extended Attributes, a Rebuilt Duplicate Finder, and Two Independent Pre-Tag Audits
The release that goes looking for the bugs that do not announce themselves. AeroRsync gains extended attributes end to end against stock rsync, -X is on by default on Unix, and the file-list, out-of-band and oversized-datum paths that carry them are bounded against a hostile peer. The Find Duplicates dialog is rebuilt around the thing it was missing: the choice of which copy to keep, with real hashes, real distances (the fuzzy "distance" was a hash value, so any sort by similarity was meaningless), live scan progress, thumbnails and per-file sizes. Seventeen provider trash views become one sortable table. A hostile-name sweep across every writable provider profile found six defects, four of which could make sync --delete remove the user's own local files, and one XML entity bug that mangled any filename with & next to a space in every listing. On Linux, six destructive actions had been asking a confirmation nobody ever saw, because WebKitGTK does not implement window.confirm: on that platform an account could be deleted with no question asked. The Snap stopped shipping a payload its own base cannot load, a break that had gone out for roughly thirty releases, and the invariant is now proven before publishing rather than assumed. Two independent adversarial audits were run before this tag, the second reviewing all 333 code candidates since v4.1.6; both are recorded in the repository, findings and accepted debt included. 47 languages, with about 5,400 strings restored word by word after a mechanical pass had stripped their diacritics.
Added
- AeroRsync preserves user.* extended attributes end to end, verified against stock rsync 3.2.7, with -X enabled in production on Unix. The work landed in stages: the file-list extended-attribute block, the out-of-band path for attributes too large to fit in an entry, then reading and applying local user.* when a session opts in.
- Find Duplicates gives the choice of which copy to keep back to the user. Any copy can be ticked, and a selection that would leave a group with no copy is confirmed by name rather than blocked. With it: per-file byte sizes, spread sorting, a 128-bit hash readout, a thumbnail on every row, and the modal scrollbar that a WebKitGTK workaround had been suppressing.
- Find Duplicates shows the hashes, sorts by similarity and takes a cutoff. The Fuzzy cutoff had never reached the engine, so the per-type defaults were the only thing anyone could actually run.
- Copy and open buttons on every duplicate row. The Copy glyph in that dialog was decorative, so comparing two candidates meant reading the path off the screen.
- Compare and Find Duplicates report files, folders, bytes, depth and elapsed time while they scan. Compare needed no new backend: the events had been emitted since the recursive scan landed and nothing was listening.
- One sortable trash table for all seventeen providers, with a Type column, aligned name header, single-line timestamps, Shift ranges, Ctrl adding and a rubber band, in a shared component instead of seventeen copies with no sorting at all.
- Calculate Size, Find Duplicates and Disk Usage run on the directory you are in, from the empty space of the panel or from any breadcrumb segment including the collapsed ancestors, instead of only from a folder row one level up (@EhudKirsh, #347).
- My Servers says which providers encrypt on this device, reading the same list as the Add Service badge, with a test holding both surfaces to it. MEGA S4 stays unbadged on purpose: it is S3 and the server holds the keys.
- Image previews on the remote panel, plus a shared LRU thumbnail cache bounded in bytes and keyed by size and mtime, which changing directory no longer clears.
- The server-side trash is reachable from the CLI (@EhudKirsh, #397).
- The Checksum tab says what a backend can hash before you click, and hashing works inside t

[4.1.6] - 2026-07-25
AeroRsync Closes the Gap With rsync, a Stabilised DAG Transfer Engine, and MTP Portable Devices
The longest-running thread in the project lands: AeroRsync gains the negotiated checksums, end-to-end symlinks and streaming signatures that were the remaining distance to stock rsync, and the legacy parallel server stack retires so production has exactly one path, the one that is tested byte-identical against rsync --server. The DAG transfer engine stops being a promising core and becomes the engine: a process-global hierarchical governor, durable multipart checkpoints, a streaming work frontier, endpoint-aware adaptive AIMD and SizeFair scheduling, with five more providers promoted onto native multipart workers. Measured against rclone on the lab, multi-file FTPS moved from 8-18% behind to parity and the FTPS single-stream default is now 41% ahead. A new protocol arrives with it: MTP/WPD portable devices, phones and cameras that the OS never gives a drive letter, with their own profile type keyed to a device fingerprint. AeroCrypt gains v4 keyslots, so a vault can be unlocked by more than one credential without re-encrypting it. A sync stack audit closes the release's most serious finding - a crafted remote filename reached the remote login shell through rsync-over-SSH - along with a class of scan-completeness holes where a truncated remote listing could steer a sync into deleting local data. 47 languages translated.
Added
- Portable devices over MTP and WPD, a new protocol with its own profile type: attached phones, cameras and media players that the OS never mounts as a drive now appear under PLACES > Portable devices and browse and transfer through the same dual-panel fabric as every other provider, via a Linux libmtp backend and a Windows WPD backend. Devices are saved as real profiles keyed to a stable device fingerprint (mtp:serial=… where the device reports one, otherwise vid/pid plus model), so a saved phone reconnects as itself rather than as whatever happened to be on that USB port; the Add Services catalog gains a Devices category and an MTP save form, the device card carries a red/green attach indicator with click-to-connect, and aeroftp-cli can open a saved device by fingerprint. USB hotplug is wired on both platforms, so unplugging a device flips the attach dot and degrades the open session honestly instead of leaving a dead panel (@EhudKirsh, #347).
- AeroFTP takes the MTP claim from the desktop instead of losing to it: only one program can hold a phone over MTP at a time, so on Linux Connect now soft-releases the system gvfs/Nautilus mount (with a settle poll, a clean gio unmount with timeout, and a SIGSTOP of the gvfs volume monitors across the open) rather than failing with an error that blamed the user for having a file manager open. Disconnect drops only the claim AeroFTP took. Where the desktop mount is the better path, PLACES rides it instead of fighting it.
- AeroRsync: md4 and sha1 as first-class negotiated checksums (Y-RSC.3): both were advertised in negotiation but never implemented, so a negotiated md4 or sha1 win silently degraded a delta transfer to all-literal traffic and skipped the reconstruction verify entirely. Both roles - the block-strong signature hash and the whole-file trailer - are now implemented in both directions, and the reconstruction is genuinely verified. The seeding mirrors the builtin-versus-EVP split of rsync 3.2.7 checksum.c: block-strong md4 appends the four-byte seed, sha1 prepends it, and the whole-file trailer is unseeded for both. Verified against stock rsync 3.2.7 by forcing each algorithm through the live lane-3 upload path for a byte-identical reconstruction, which proves our md4 and sha1 are accepted by rsync's own receiver verify.
- AeroRsync: symlinks transferred end-to-end on unix (Y-RSC.4): a source symlink is detected by lstat and never followed, emitted as an S_IFLNK file-list entry carrying the link target under rsync's F_LENGTH convention, wit

[4.1.5] - 2026-07-15
Non-Identical Duplicate Detection, Restartable Transfers and AeroCrypt Portability
Find Duplicates gains near-duplicate detection across images, text and arbitrary payloads, exposed in the GUI, CLI and agent tools and always opt-in. The transfer queue now survives an app restart, bringing interrupted transfers back as re-queueable Restored items. AeroCrypt gains portability and safety work: an advanced default-salt mode, a shared .aerocrypt.tsv marker with verified migration, an offline Emergency Kit validity check, and a missing headed marker rebuilt from the local keystore. Password Forge becomes always-discoverable with reusable presets and honest 2FA-secret handling, classic rsync animates a live progress bar, and the CLI honours machine-mode and banner environment variables consistently. 47 languages translated.
Added
- Non-identical duplicate detection across the engine, GUI, CLI and agent tools: a shared engine routes raster images through pHash, text including SVG through SimHash with a MinHash cross-check, and any other payload through pure-Rust TLSH; the GUI and CLI expose Exact and Non-identical modes, local_find_duplicates delegates to the shared engine with similarity metadata, and aeroftp_dedupe / remote_dedupe support non-identical staging with similarity and distance while preserving the remote exact SHA-256 fast path. Non-identical mode is opt-in and never auto-selects files for deletion (@EhudKirsh, #383).
- The transfer queue survives an app restart: interrupted queue items are journaled atomically to aeroftp_data_root/transfer-queue/queue.json as re-executable descriptors, and on the next launch any transfer that was still pending or in flight comes back as a re-queueable "Restored" item with a Retry action. Restored items do not auto-start or auto-reconnect: after you reconnect to the same server, Retry re-runs them through the normal transfer path. Verified live end to end (persist, restart, restore, real re-upload of a 100 MB file). Per-provider byte-range resume stays deferred.
- AeroCrypt default-salt portability and TSV marker migration: default-salt mode is an advanced opt-in with a password-strength gate, explicit attestation and salt-mode MAC binding, and the recovery kit gains QR export controls; new headed markers write .aerocrypt.tsv while the legacy .aeroftp-crypt.json stays readable, and CLI and GUI migration verifies the new marker before deleting the old one (@EhudKirsh, #276).
- Emergency Kit validity check (crypt kit-verify and GUI Verify): a saved kit text, QR dump, .aerocrypt.tsv or legacy .aeroftp-crypt.json can be re-parsed offline and checked against the active profile keystore (vault id, salt, version, KDF) without a recovery drill or password, from the CLI crypt kit-verify, the Tauri aerocrypt_verify_recovery_kit command and the Recovery Kit modal Verify action with native Save and Print (@EhudKirsh, #276).
- Password Forge and encrypted-provider credential hardening: Security Tools is always discoverable, the generator supports reusable presets including Compatible 32, granular and custom character sets, exclusions, guaranteed selected groups, batch generation and live entropy, and inline generation covers AeroVault, encrypted overlays and protected archives. Saved Filen and MEGA 2FA secrets are demoted behind a collapsed advanced disclosure with an honest warning, Filen bridge credentials enforce the documented 32-character restrictions, and MD5/SHA-1 are marked legacy (@EhudKirsh, #266, #369).
- CLI machine mode via AEROFTP_MACHINE: a truthy AEROFTP_MACHINE enables machine and agent output mode as an equivalent to --machine, resolved right after argument parsing so agents and CI no longer repeat the flag on every call.
Changed
- AEROFTP_NO_BANNER realigned to the strict_env_truthy convention: it now matches AEROFTP_STRICT and AEROFTP_MACHINE, so only 1, true, yes or on suppress the banner, and =0 or =false no longer do.
- The Linux release workflow retries tr

[4.1.4] - 2026-07-13
AeroCloud Multi-Pair Sync, Headerless AeroCrypt with an Optional Recovery Kit, a Strict Overlay Scope, and a CLI Agent Mode
AeroCloud grows from a single GUI-only folder into a real multi-pair sync engine reachable from the CLI, with delete propagation, one-way modes, a tunable real-time watcher, SFTP key auth and a compression overlay. AeroCrypt's default becomes a lean headerless base that writes nothing on the remote and opens with just your key, paired with an optional on-demand Recovery Kit that works in every mode and a strict sub-folder overlay scope, plus an opt-in same-name privacy hint. The CLI gains an agent-friendly machine mode and a remote find-and-replace edit, native profile backups round-trip every field, and Windows learns to open archives and expose an in-app File associations panel.
Added
- AeroCloud multiple sync pairs: run more than one local-to-remote pair per install, each with its own saved profile, protocol, direction, sync index and crypt overlay, driven by the same background worker and reachable from the CLI (aeroftp-cli aerocloud pair list/add/remove/enable/disable/sync). A dedicated cloud_pairs.json store keeps each pair's sync index isolated by a per-pair id plus a duplicate-target guard, an empty store falls back to the legacy single config, and the connect-wrap-sync sequence is unified into one helper the worker and CLI share. Verified headless with two independent pairs (MEGA and Koofr) synced in one pass. All 46 non-EN locales (@EhudKirsh, #405).
- AeroCloud delete propagation: a file deleted on one side is now removed on the other instead of the surviving copy resurrecting it, an index-aware decide-and-execute with a safety gate on both the provider and FTP twins. This is the line between sync and copy. Verified headless on a real MEGA remote (@EhudKirsh, #405).
- AeroCloud send-only and receive-only folders: per-folder direction (bidirectional, send-only, receive-only) with a preserve-remote-deletes toggle for additive backup versus strict mirror (@EhudKirsh, #405).
- AeroCloud from the CLI: aeroftp-cli aerocloud show/set/enable/disable/status/sync configures and runs AeroCloud headless where it used to be GUI-only, the first step toward the AeroCloud and AeroSync engine convergence (@EhudKirsh, #405).
- AeroCloud SFTP key-based auth: a saved key-auth SFTP profile, plaintext or passphrase-protected, now works as an AeroCloud target, covering both the background worker and aeroftp-cli aerocloud sync (@EhudKirsh, #405).
- AeroCloud AeroCompress overlay: compression is now a real per-config and per-pair overlay composed outside the crypt builder, so upload order is compress then optional encrypt; levels persist and are editable from the GUI and CLI. Verified on MEGA with zstd and stored modes and byte-equal round-trips (@EhudKirsh, #405, #276).
- AeroCloud real-time watcher tuning: the debounce quiet period and the cooldown between watcher-triggered syncs are now editable from the GUI and CLI (aerocloud set --watcher-debounce-ms / --watcher-cooldown-secs), answering the bandwidth concern about real-time sync (@EhudKirsh, #405).
- Overlays Remote Path, a strict sub-folder crypt scope: pin an AeroCrypt overlay to a strict descendant of the connection Remote Path (connect into /data, encrypt only /data/vault, pass everything outside through as plaintext), from the GUI Connection screen and the CLI crypt bind. Relative UX, live validation that rejects an ancestor, sibling or prefix-trap, empty means same-as-Remote-Path, and the scope locks once bound. All 46 non-EN locales (@EhudKirsh, #369).
- Optional same-name privacy hint for encrypted vaults: an opt-in setting (Privacy, off by default) that, inside an active crypt overlay, flags files and folders whose plaintext name also appears at another path you have browsed. Filename encryption is deterministic, so identical names are visible as identical to an observer of the encrypted store, the same tradeoff as rclone-crypt and C

[4.1.3] - 2026-07-11
Archive Encryption and Compression at a Glance, Crypt-Overlay Scope with Keyfile 2FA, Safer CLI Deletes, Faster SFTP Listing and macOS Stable
A polish-and-hardening release: AeroFTP surfaces archive encryption, real compression method and AeroVault generation at a glance in both the local and remote file browsers without downloading anything, the crypt overlay now shows plaintext outside its bound subtree and decrypts only inside it across the GUI, CLI and MCP and gains an optional keyfile second factor, the destructive CLI delete verbs get a real dry-run preview with recursion now opt-in, recursive SFTP listing is about three times faster, macOS is promoted from beta to stable, and a broad security audit runs the length of the cycle. Pre-tag commit audit: PASS, the final pre-release audit closed six integrity, fail-open and race residuals; 47 languages translated.
Added
- Optional keyfile second factor for native AeroCrypt: a "something you have" file mixed into the key derivation (stronger than rclone's password2) with no change to the on-disk object format; generate a transfer-safe keyfile from the GUI or CLI, make a vault keyfile-only (an empty password is legal), and the keyfile path travels through profile export/import as a re-pointable pointer that resolves fail-closed at connect across GUI, CLI and MCP (@EhudKirsh, #272).
- Archive encryption, compression and AeroVault generation surfaced at a glance in the local file browser: a padlock next to the Type (closed emerald for a strong cipher, amber for weak ZipCrypto, open grey for a detectable but unprotected archive) for password-protected zip, 7z and RAR showing the real detected cipher (AES 256/192/128, ZipCrypto, RAR5 AES-256, RAR4 AES-128), an optional Encryption column, a Compression column with the real method (Deflate, BZip2, LZMA, LZMA2, PPMd, Zstd, or Store for an uncompressed archive), and an AeroVault generation chip (v2/v3/v4) on our own .aerovault, .aeroftp and .aeroftp-keystore containers; detection reads only the archive header lazily and never downloads or opens the file, and a locked archive gets a dedicated draggable unlock modal that names the real cipher.
- New Date format setting (Settings > General): choose how dates render app-wide (Localized, ISO 8601, DD/MM/YYYY or MM/DD/YYYY), applied live to the file browser and every other date with no restart; localized dates now follow the selected app language instead of the OS locale.
- The same encryption and AeroVault surfacing on the remote panel: an .aerovault, .aeroftp or .aeroftp-keystore on a remote, plus password-protected third-party zip and 7z, show the padlock, Encryption column and AeroVault chip without downloading the file, reading only the header via provider ranged reads; scoped to the range-capable transports (SFTP, FTP/FTPS, S3, WebDAV, Backblaze B2, Koofr, and now Azure Blob, Uploadcare, Cloudinary and ImageKit) and degrading to no badge where a transport cannot serve byte ranges.
- The crypt overlay now shows plaintext outside its bound subtree and decrypts only inside it, from the CLI and MCP too (CWP-20C): ls, tree, lsjson and the MCP listing tools were reporting a scoped-overlay remote whose root is not the vault as empty or as only its encrypted items; the read path is now scope-aware (decrypt strictly below the anchor, pass everything at or outside it through as raw plaintext) while every write stays fail-closed so plaintext can never land where ciphertext is expected, verified live on Filen and lab SFTP (@EhudKirsh, #369, #266).
- CLI --no-crypt connect flag to bypass a bound crypt overlay and connect raw, mirroring the GUI crypt button and closing a CLI-parity gap (#390).
- Full S3 trash and version management: browse soft-deleted objects and delete markers under a prefix, undelete, copy-forward an older version to current, purge a single version, and empty the trash with a dry-run preview, from the GUI, the CLI (versions trash / versions purge / versions e

[4.1.2] - 2026-07-05
Complete Archive Format Coverage, Quick Connect Consistency and a Full-Surface Security Audit
An archive-focused release: a format-coverage audit closed every gap it found, so what AeroFTP creates it can always reopen, and archives from native tools (7-Zip, gzip, WinRAR) open reliably. A single file now compresses to and extracts from a plain .gz, .xz or .bz2, the Compress dialog gains a 7z Advanced section, ZIP archives using non-Deflate methods now open, tar symlinks extract safely, and the compression presets align with the 7-Zip canonical levels. Alongside archives: a full-surface security audit fixed 16 findings, AeroShare gains offline LAN (mDNS) discovery, and a broad Quick Connect consistency pass lands with the crypt-overlay fixes reported against v4.1.1. 47 languages translated.
Added
- Standalone gzip / xz / bzip2, full round-trip: a lone file compresses to a plain .gz, .xz or .bz2 with no tar wrapper, and extracts back through the real extract path (member name = archive name minus the codec extension). The Compress dialog adds GZ/XZ/BZ2 cards enabled only for a single non-folder selection; the CLI infers the format from the extension (longest match keeps foo.tar.gz a tarball) and the CLI, GUI and AI extract verbs all reach the standalone lane, including a .gz produced by system gzip. (#365)
- 7z Advanced options: content method, dictionary size, solid block, threads: a collapsed Advanced section in the Compress dialog, with matching aeroftp compress flags, exposes the 7z content method (LZMA2 default, plus LZMA, PPMd, BZip2), an LZMA2 dictionary size and thread count, and a solid-block option (one pack for every file: better ratio on many small files, off by default). Every method is decodable by the extractor, so an unreadable archive is never created. (#365)
- ZIP archives with non-Deflate methods now open (BZip2, LZMA, Deflate64, Zstd, XZ): these previously failed with "unsupported compression". The read codecs are now enabled and such archives extract byte-exact; the write path is unchanged (AeroFTP still emits Store/Deflate + AES, which every native archiver opens). Full bidirectional interop with 7-Zip verified.
- AeroShare LAN (mDNS) discovery: a new lan discovery mode resolves peers over local mDNS only, publishing nothing to n0 or the public DHT, so two devices on the same subnet find each other fully offline (no internet, no relay). mDNS is also folded into the default both mode, so LAN peers resolve instantly there too. (@EhudKirsh, #284)
- aero benchmark --all-protocols alias for the existing --all flag (benchmarks every saved profile), so the intent reads clearly. (@EhudKirsh, #277)
Changed
- Compression level presets aligned with the 7-Zip canonical levels: the Compress dialog now offers six presets (Store=0, Fastest=1, Fast=3, Normal=5, Maximum=7, Ultra=9) shared across all compressible formats; 7z and the tar.gz/tar.xz/tar.bz2 family drop Store since their codecs have no real store mode. The default level moves from 6 to 5 (7-Zip "Normal") in the dialog, in every backend fallback and in the CLI --level help. (#365)
- 2FA Quick Connect polish (Filen, MEGA, Internxt): the six-digit Two-Factor Code field is compact (six digits, centered, 000000 placeholder) and digit-only, the code auto-submits the moment the sixth digit lands, and on Filen and MEGA the live TOTP preview (key, code, copy, timer) sits on the 2FA Secret label row. (@EhudKirsh, #369)
- Interactive -i sections split clear from cls / .: in profiles -i, groups -i and users -i, clear now does a plain screen wipe with no reprint (the universal terminal behaviour), while cls, the single-key . and refresh keep the clear-and-reprint refresh. (@EhudKirsh, #266)
- Add Service catalog refinements: a single Grid/Table "switch to" toggle (mirroring My Servers), the generic-servers strip filtered to the active tab, Microsoft-prefixed OneDrive and Azure Blob so the two sort together, consistent S3 / WebDAV / API badge order, and co

[4.1.1] - 2026-07-01
Transparent Crypt Overlays, AeroShare Privacy Controls and 7z Encrypted Headers
A consolidation release built on the v4.1.0 feedback. Encrypted-overlay profiles (AeroCrypt and rclone-crypt) now stay encrypted through one transparent decorator wired at every provider chokepoint, so no surface can bypass the overlay and write plaintext into an encrypted store. AeroShare gains the two deferred P2P privacy controls (an anti-flood gate and a public-DHT opt-out), 7z can create archives with encrypted headers to hide filenames, Kilo Gateway joins the native AeroAgent providers, and a broad triage batch closes the confirmed bugs reported against v4.1.0. 47 languages translated.
Added
- Transparent crypt overlays end to end via a single decorator: encrypted-overlay profiles (native AeroCrypt and rclone-crypt) are now wrapped by one CryptOverlayProvider wired at every provider resolver chokepoint (CLI, cross-profile, AeroAgent, MCP, GUI, AeroCloud background sync, the selective-sync folder tree), so a surface that resolves its own provider can no longer bypass the overlay and write plaintext into the encrypted store or read ciphertext back. The decorator is fail-closed: a bound-but-locked vault is refused, never downgraded to raw. This grew out of an AeroSync compare/sync mismatch on a crypt profile where the overlay was applied ad hoc per command. (@EhudKirsh)
- Resume interrupted transfers: a Resume action continues an interrupted upload or download from where it stopped instead of restarting from zero.
- 7z create with encrypted header (-mhe) to hide filenames: opt-in like 7-Zip's "Encrypt file names" checkbox under the password. Off keeps content-only encryption (names readable); on hides the names too and then requires the password even to list the archive. Migrated from the unmaintained sevenz-rust 0.6 to sevenz-rust2 0.21. Wired into the Compress dialog and the CLI (aeroftp compress --encrypt-names); encrypted-header archives open in the existing GUI browser and standalone extract window. (#365)
- AeroShare anti-flood gate and public-DHT opt-out (the two AeroShare P2P follow-ups deferred from the v4.1.0 audit): inbound knocks, actions and file offers are gated before they reach the UI with a per-sender mute (always on), an optional friends-only allowlist (off by default to preserve first contact) and an in-memory sliding-window rate limit (default 20 signals per sender per minute, 0 disables). The long-term AFID can be kept off the public DHT with a new none discovery mode, discovery is now a persisted per-partition setting (both/dht/n0/none, all in Settings), and a destructive AFID rotation is guarded by a two-step confirm and stops every live served share first. New AeroSharePrivacySettings panel and a Mute-sender action on the knock prompt, 29 i18n keys across 47 locales. (#284)
- Kilo Gateway as a native AeroAgent AI provider: an OpenAI-compatible gateway routing to many open and free models behind one key, including the rotating Auto Free model (kilo-auto/free, 256K context, no credits required), plus paid Anthropic, OpenAI and Mistral with a signup credit. Wired through the existing OpenAI-compatible dispatch with full CLI parity. (#382)
- Benchmark group and all selection: aero benchmark --group <NAME> (repeatable, comma-aware) benchmarks the members of a My Servers group and --all benchmarks every saved profile, so a comparison needs no manual list. A profile-type column disambiguates multi-protocol profiles, the many-small-files run shows a live progress bar instead of a blind wait, and a mid-run public-IP change that reverts before the sweep ends still flags the comparison as not comparable. (@EhudKirsh, #277)
- AeroSync receipt item total and JSON export: the sync success banner now prints the total item count (uploaded plus downloaded plus deleted plus folders created) so it reconciles at a glance with the compare difference count, and an Export JSON button saves the full run report as pretty JSON

[4.1.0] - 2026-06-28
AeroShare Peer-to-Peer (Beta Preview), the AeroAgent Coding Loop and Per-User Groups
The headline of v4.1.0 is AeroShare, a Beta preview of direct, end-to-end-encrypted device-to-device transfer with no server in the middle. It is the seventh module of the Aero Family: send a file or a folder straight to another person over a peer-to-peer channel (iroh 1.0 with Mainline-DHT discovery and federated relays), always-on at launch, with a Discover tile, a titlebar +friend button, a draggable hub and a status-bar receiver indicator. Alongside it, AeroAgent gains a foundation coding loop (a curated, GUI-only, approval-gated tool set for local development), server groups and favourites move into each user's encrypted partition, the interactive CLI grows a New(N) verb and per-user management, the aero benchmark defects are fixed, the Filen Desktop bridges work headless, OS "Extract here / to folder" verbs land on Nautilus and Windows, Windows USB eject works, and the in-app sigstore update verification verifies for real again. The P2P stack was migrated from iroh 0.92 to 1.0, clearing 6 Dependabot alerts. 47 languages translated.
Added
- AeroShare: end-to-end-encrypted peer-to-peer transfer (Beta): send files and folders directly to another user with no hosted account in the middle, over a peer-to-peer channel built on iroh 1.0 with decentralized Mainline-DHT discovery and federated relays as fallback. AeroShare is now always-on at launch (it was hidden behind an off-by-default Settings flag and undiscoverable): the Discover tile carries a 256-bit E2E badge, the +friend button sits in the titlebar, and the handshake dialog is always available. Adding a friend or sharing a folder auto-activates the feature; the standing receive loop is opt-in via a one-time prompt, both changeable from Settings. Each sender gets their own Inbox and an address book remembers the people you exchange with. The hub dialog is draggable by its header and a status-bar pill next to AeroCloud surfaces the receive loop at a glance and toggles it on click. i18n 47/47. (@EhudKirsh, #284)
- AeroAgent coding loop (foundation): a curated GUI tool set for local coding work, GUI-only and either read-only or approval-gated, with no change to the transfer or file-management tools. It adds ripgrep workspace search, structured cargo/tsc/eslint diagnostics, git read (log/show) plus stage and commit, a run-checks runner and an ordered multi-check verify, safe patch with automatic checkpoints, and review cards.
- Native CLI profile export/import (@EhudKirsh, #215): aeroftp-cli profile-export and profile-import write and read an encrypted .aeroftp profile backup, byte-compatible with the GUI's My Servers Export/Import (a file made in one imports in the other). It reuses the GUI's exact collect/restore path, so the per-protocol credential snapshots are shared, not duplicated; secrets are opt-in via --include-credentials.
- Per-protocol credentials survive profile export/import (@EhudKirsh, #215): a one-account-many-protocols profile (for example a Koofr account saved as Native API + WebDAV) now keeps each mode's saved credentials across export and import. The per-protocol snapshots, the "Remember credentials for every protocol" opt-in and the OAuth Remote Path field all round-trip, and the import dialog's "contains credentials" badge accounts for every secret kind.
- Interactive New(N) verb across profiles -i / groups -i / users -i (@EhudKirsh, #311): create a profile, group or user from inside the -i loop (the rclone n) New remote model) instead of dropping out to a separate add command. profiles -i n [query] runs a service-first catalog picker; groups -i n makes an empty group; users -i n a new local user.
- groups -i member add/remove (@EhudKirsh, #311): a <group> <profile...> and x <group> <profile...> curate a group's membership from inside the loop, idempotent and multi-target.
- Per-user server groups and favourites (CLI + GUI): groups and favourites 

[4.0.9] - 2026-06-24
AeroVault Create Redesign, the AeroVault Zip Plaintext Lane and Universal rclone Export
A large pass on AeroVault and the bridge. The vault create flow is rebuilt to match the Compressor: a named vault, mode cards with a conditional password, a result receipt instead of a jump into the browser, and a single tabbed shell (Home, Recent, Files) shared by the standalone modal and the browser. A new AeroVault Zip plaintext lane adds a fast, honestly-unencrypted .aerozip archive format for cases where compression matters and confidentiality does not, with optional recovery parity and a real measured size estimate. AeroMount gains a read-only mount and a one-shot Save-All for unlocked vaults (Ehud Kirsh's idea #1). On the bridge side, rclone export now reaches Filen and every OAuth cloud provider, not just import. The release closes a pre-release audit of all 86 changes (12 findings, including a formatting gate that was red on the previous commit) before tagging.
Added
- AeroVault create rebuilt Compressor-style (@EhudKirsh, #322): a required Vault Name drives the saved filename, the security level and compression are chosen on mode cards, the password field only appears for an encrypted vault, and create ends in a result receipt with the size composition instead of dropping you into the browser. The create form gained hover states, a reset button, a padlock and format label, an encryption badge and proportional before/after size bars.
- Unified tabbed AeroVault shell: the standalone modal and the in-browser view share one tab strip (Home and Recent standalone, Files and Recent in the browser), with the recent-vaults list extracted into a single reusable component rendered in both.
- AeroVault Zip plaintext archive lane (.aerozip): a new fast, unencrypted archive format with a CLI (aeroftp aerovz) and a GUI scaffold, opened by header on double-click with the OS file-type association registered. The copy is explicit that it provides no confidentiality. Recovery parity is opt-out (default on); --recovery-level 0 (or off/none) disables it.
- AeroMount read-only mount of unlocked vaults (@EhudKirsh, #322, idea #1): mount an unlocked Cryptomator vault, .aerovault or .aerozip as a read-only filesystem in your OS file manager. It is ephemeral and session-bound, the password is passed over stdin and never stored, and it auto-unmounts when you lock the vault or quit. Linux first.
- AeroMount "Save all..." for unlocked vaults (@EhudKirsh, #322, idea #1): export the whole decrypted tree of an unlocked Cryptomator vault, .aerovault or .aerozip in one shot, to a folder, a single .zip or a single .aerozip, instead of one file at a time. A shared ReadableVault seam drives a streaming zip writer for both container types, behind a confirm dialog that flags the plaintext export.
- Real graphical compressed-size estimate: the Compress and AeroVault Zip dialogs show the estimated output size as a bar that updates on every option change. A backend canary samples the actual input, compresses it with the chosen codec and level and extrapolates (exact when the whole input fits the sample cap).
- Live progress bars and a busy-lock for archive and vault operations, with a byte-true inverse bar and an honest result for incompressible input.
- Grid and list view in the AeroVault browse modal, the Cryptomator browser and the archive browsers, with a 3-level small/medium/large icon toggle and larger container modals.
- Export Filen and the OAuth cloud providers to working rclone remotes (@EhudKirsh, #128): Filen, Google Drive, Dropbox, OneDrive, Box, pCloud, Yandex, OpenDrive and Backblaze B2 now export to rclone.conf as usable remotes, not just import, extending the earlier Jottacloud-only export. Filen carries email, password and its CLI api key; the OAuth backends emit the AeroFTP-persisted token that rclone refreshes on first use (OneDrive also drive_id/drive_type, pCloud the EU hostname); OpenDrive and B2 their account secrets.
- Active 

[4.0.8] - 2026-06-22
AeroProgress, Quick Connect Polish and AeroCrypt as a First-Class Profile
A flagship pass on the transfer and encryption progress experience (AeroProgress): the floating transfer card is back with a lane per file, live speed, ETA and bytes, a collapsible speed graph and per-theme styling, and the Transfer Queue, vault creation and cross-profile transfers all report real progress instead of a bare spinner or a frozen "Streaming" state. Around it, Quick Connect gets the polish from Ehud Kirsh's v4.0.6 connection review (#215), including a per-mode credential isolation fix and an app-aware local-bridge detector, and AeroCrypt is promoted from the roadmap to a first-class Crypt profile type with a navigate-out encrypted scope (#272). The Windows portable build and the contributor setup docs round out the release.
Added
- AeroCrypt is a first-class Crypt profile type: the native AeroCrypt overlay and the rclone-crypt interop overlay (equal grade) now show as a single Crypt class in My Servers and in aeroftp-cli profiles, with an Encrypted marker on the card, instead of living only in CLI commands and .sh / .ps1 automation. Public share links and server-side checksums are disabled while inside the encrypted area, since they would act on ciphertext, not your file. (@EhudKirsh, #272)
- Navigate-out encrypted scope: one connection can bind the overlay to a subfolder, show its contents decrypted, and step above it to see the rest of the server in clear (the path-bar badge switches to an "outside" state), then step back in to transparent decryption. A single fail-closed rule drives the badge, the transfer routing and the action gating, so the badge can never disagree with what an operation actually does. (@EhudKirsh, #272)
- Live progress bar for AeroVault create and add: creating a vault or adding files now shows a live progress bar for the compression and encryption stage with real bytes, instead of a bare spinner, which is most useful on a large vault that takes a few seconds.
- App-aware local-bridge detector: the Filen Desktop / MEGAcmd "Local WebDAV / Local S3" modes show a live 🔴/🟠/🟢 status dot and an app-aware message (not installed / installed but not running / active) in place of the static "Requires …" warning, and Save is disabled only when the helper app is confidently not installed. (@EhudKirsh, #215)
- CLI aeroftp profiles --health: an opt-in flag that probes the local-bridge helper apps for every bridge profile and prints a 🔴/🟠/🟢 status line after the table, mirroring the GUI detector (off by default so the plain listing stays instant). (@EhudKirsh, #215)
- Per-theme progress styling: the progress card, the shared progress bar and the speed graph have a dedicated look for every one of the 8 app themes (light, dark, true dark, tokyo, cyber, green, ice, redhorse), instead of the extra themes falling back to the dark gradient.
- Settings opt-out for the transfer progress card: shown by default, under Settings then General, for users who prefer not to see it.
- Export a technical report from an open vault and OS drag-and-drop with mixed file/folder staging for AeroVault.
- Change Mode for an open vault: re-pack a vault under a new security level (Standard / Advanced / Paranoid / Archive), compression profile and Error Correction, keeping the same password. It moves a vault between the v2 and v3 formats and toggles the AES + ChaCha20 cascade by re-encrypting every file in place, available next to Change Password in the GUI and as aeroftp vault change-mode in the CLI. (@EhudKirsh)
- Full AeroVault command parity in the CLI, so every file-management operation in the GUI is now scriptable for automation and agents: add --to-dir, add-dir (recursive folder add), extract-all (whole-vault, tree-preserving), mkdir, rm, mv, cp, change-password, compact, scan-dir, sync-compare / sync-apply and recovery-status, each auto-detecting the v2 / v3 format from the file.
Changed
- Archive vault preset lowered to zstd 

[4.0.7] - 2026-06-18
AeroVault Security Audit Hardening and Error-Correction Convergence
AeroVault went through an independent dual blind security audit (Claude Opus 4.8 and Codex GPT-5) followed by full remediation and a two-round adversarial controaudit that closed every finding (1 High, 1 Medium, 3 Low, 4 Info, 0 Critical, grade A). In the same pass the error-correction engine became a single audited implementation living in the published aerovault crate (0.6.2) instead of a copy forked into the app, and the My Servers grid got a pair of layout fixes.
Fixed
- No leftover temp or lock after an interrupted vault seal: killing a vault operation mid-seal used to leave a 56-byte .aerovault.lock that blocked the next writer and an 8 GB .aerovault-v3-XXXX plaintext temp beside the target. The container now writes through an auto-deleting temp on the error path, the standalone repair scrubs its temp on the persist-error branch (M1), and a lock orphaned by a crashed run is auto-reclaimed once its recorded owner PID is provably dead, via an atomic rename-aside (M9). (@EhudKirsh, #2)
- AeroVault extract blocks reparse-point escape: extracting a vault could follow a pre-planted intermediate Windows directory junction out of the destination, writing decrypted plaintext into a sibling directory. Each path component is now created refusing to follow a pre-existing reparse point, and the canonical parent is checked to stay inside the destination root (M2).
- correct repair honors an authenticity anchor: a bare repair reconstructed toward whatever hash the sidecar declared, so a planted same-length sidecar could drive it to attacker content. A new --expect-sha256 anchor refuses a sidecar that declares a different hash before any byte is written, on the CLI, the library and the MCP tool (M3).
- AeroVault rejects a forged extension directory at open: the header MAC covered the extension-directory offset and length but not its JSON bytes, so a forged directory is now rejected at open, before any recovery uses it (M4).
- AI local tools resolve absolute POSIX paths on Windows: a /-rooted path was treated as relative on Windows and re-based under the tool working directory; a leading / is now treated as absolute on every operating system.
- IntroHub layout: the My Servers grid now uses container-aware column counts (3 to 9) with a full-height sidebar divider, symmetric grid gutters, and aligned toolbar and cards.
Changed
- Error correction converged onto the aerovault crate (0.6.2): the app's forked standalone .aerocorrect and AeroSync error-correction engine (about 3,500 lines) is removed and replaced by a logic-free re-export of the crate, so the .aerocorrect format has a single audited implementation shared by the desktop app, the CLI and any Rust consumer. A cross-implementation golden keeps the bytes byte-for-byte identical (M7).
- Accurate AeroVault error-correction capability string: the app reported error correction as a Phase 1 stub while shipping live Reed-Solomon error correction; the capability string now reflects the real RS engine (M5).
Security
- AeroVault dual blind security audit, grade A: an independent dual blind audit (Claude Opus 4.8 and Codex GPT-5) plus full remediation and a two-round adversarial controaudit closed 1 High, 1 Medium, 3 Low and 4 Info findings with zero Critical and zero open findings, verified on both the crate and the app. The kill-cleanup pair (M1 and M9) was surfaced by Ehud Kirsh's V3 Beta test pass. (@EhudKirsh, #2)
- DOMPurify updated to 3.4.11: clears a Dependabot advisory (GHSA-cmwh-pvxp-8882, ALLOWED_ATTR pollution via setConfig). A precautionary transitive bump; the affected configuration path is not exercised by AeroFTP.
Contributors
@EhudKirsh
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[4.0.6] - 2026-06-17
AeroVault Crate Convergence
AeroFTP's AEROVAULT3 vault engine and its revision 4 Reed-Solomon error correction now live entirely in the published aerovault crate, so the desktop app, the standalone CLI and any third-party Rust project all run a single audited implementation instead of parallel copies. The app keeps only thin command wrappers over the crate, and the container format is now defined and tested in one place.
Changed
- AeroVault engine moved into the aerovault crate (0.6.0 on crates.io): the full AEROVAULT3 container (1024-byte header, gear content-defined chunking, per-chunk zstd, keyed-BLAKE3 deduplication, small-file packing, authenticated manifest) and revision 4 Reed-Solomon error correction are now owned by the crate. The app's vault_v3_* commands became thin wrappers over it, removing about four thousand three hundred lines of duplicated cryptography. A cross-implementation fixture pins the app and the crate to byte-for-byte identical containers, so a vault created by either side opens and extracts in the other and existing vaults are unaffected. AEROVAULT3 design and the unified .aerocorrect direction were driven by Ehud Kirsh. (@EhudKirsh, #162, #276)
- Benchmark profile picker uses a checkmark: the full-screen benchmark profile picker marks selected rows with [✓] instead of [x]. (@EhudKirsh, #277)
Fixed
- Folder uploads honor the skip and overwrite policy: uploading a folder to a cloud provider accepted a file-exists policy but silently ignored it, so re-uploading a tree re-sent unchanged files. The policy is now applied per file and the skipped count is reported. Found by an independent CLI security audit.
Contributors
@EhudKirsh
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[4.0.4] - 2026-06-07
Reversible Restricted-Filename Encoding, CLI Polish and Stability
A focused follow-up to v4.0.3. Filenames that a provider would otherwise reject now round-trip transparently on Box, Dropbox, Jottacloud and OpenDrive; the interactive CLI absorbs the next wave of the community wishlist (#270); and three stability bugs are fixed, including a long-standing tray crash on suspend/resume, a zero-size main window on macOS Tahoe (#290), and an OAuth reconnect that re-ran the full browser flow every time (#270).
Added
- Reversible restricted-filename encoding (#272, #266): Box, Dropbox, Jottacloud and OpenDrive now transparently encode filename characters the provider rejects (control characters plus each provider's reserved set) using the rclone-compatible reversible scheme (fullwidth and control-picture mappings, a quote-collision escape, and position-dependent space and dot rules), then decode them back on listing. A name like a:b round-trips intact instead of failing silently. The encode/decode runs once at the provider boundary, so it covers the GUI, every CLI cmd_* handler, CLI sync/benchmark, the transfer engine and the session manager at once, and is property-tested decode(encode(s)) == s over tens of thousands of cases per provider. Providers whose only restriction is control characters keep the clear localized error from v4.0.3. (@EhudKirsh, #272/#266)
- CLI interactive shell polish (#270): the profiles -i user-switch now accepts the compact u3 / 3u tokens (it was the only action that still required the spaced u <N|name> form), and a # <selector> <N> reorder reprints the table with a visual diff: a red struck-through ghost at the old slot, the live row at the new slot joined by a left-gutter arrow, and old -> new markers on every row whose index shifted. (@EhudKirsh, #270)
- Lightweight CI checks job: a fast workflow runs cargo fmt --check, cargo audit (RustSec advisory scan) and the vitest React suite on every PR and push, outside the heavy Tauri build/release matrix, closing three gaps in CI coverage.
Changed
- Discover health-check toggle is now an icon-only button: the Activity icon is lit when health checks are on and dimmed when off, replacing the sliding switch for the same on/off affordance (role=switch and aria-checked kept). The manual Check button is unchanged.
- My Servers filters: My Servers gains a "Local bridge" filter chip. The free/paid and HQ-country signals stay on the Discover page, where they help before you sign up, and were dropped from My Servers, where an already-saved server makes them redundant.
- PixelUnion catalog corrected to 16 GB free storage with a free API, regenerating the CLI catalog, README and docs/PROVIDERS.md from the single source of truth.
Fixed
- macOS Tahoe zero-size window (#290): the main window could come up at a 0x0 content size on macOS 26 Tahoe, leaving only a Dock icon. Two causes are addressed. First, a window-state file poisoned by the pre-v4.0.3 borderless builds saved a 0x0 size, so even after the v4.0.3 overlay title-bar fix the window was restored at zero size; the app now self-heals any restored inner size below the minimum (or zero) by resetting it to the computed initial size and re-centering, repairing already-poisoned state files without the user deleting anything (idempotent on healthy windows, cross-platform). Second, the reporter confirmed the WebKit content can still collapse to 0x0 at show() time even with a completely fresh config, so the size is now also re-asserted after the window is on screen (the documented WebKit workaround) and re-checked on a short delay, with timestamped [diag #290] lines added at four points to pinpoint exactly when a collapse lands. (@alexhorner, #290)
- Default account skipped welcome after tray Quit (#270): with more than one passphrase-free account the boot picker reappeared on every relaunch instead of entering the starred default, because a persisted password-free active user reported as already unlocked a

[4.0.3] - 2026-06-05
Community Roadmap, CLI Security Audit & Transfer Hardening
A community-driven release: the Add Service catalog is rebuilt (#224), the Ehud wishlist lands across several waves (#270), the MEGAcmd WebDAV bridge is fixed end-to-end (#275/#264), and a two-stage independent CLI security audit hardens every destructive and agent-facing surface. It also fixes window presentation on macOS Tahoe (#290), isolates development from the released app's credentials (#302), and folds in the DAG transfer audit patch sets and the server-side-copy migration.
Added
- Add Service catalog overhaul (#224): the Add Service page becomes a company-centric catalog with a list view alongside the grid, per-protocol categories that split a company's products, available storage regions shown inline, a free/paid filter, in-grid search, and provider website links. A matching CLI catalog subcommand mirrors the same data from a single source of truth. (@EhudKirsh, #224)
- MEGAcmd WebDAV bridge auto-arm (#275, #264): connecting a MEGAcmd profile auto-arms the local WebDAV bridge with a warmup notice; keep-alive reuse is disabled and transport errors are detailed, fixing single-file image preview. (@EhudKirsh, #275)
- Connection UX: cancel an in-progress connection with Esc, plus a slow-connect modal while a connection is still establishing.
- Backblaze B2 concurrent Range download for the native provider.
- CLI: interactive tree depth control with a MEGAcmd warmup notice, a raw-mode arrow-key navigator in the interactive profiles -i shell, and dedupe --force / --max-delete for the destructive resolution modes.
- Wishlist items (#270): tray restore from minimize, view-as-text in the preview pane, Yandex storage quota, image-preview transparency background, multi-user welcome polish, an offline-users note, and assorted copy fixes. (@EhudKirsh, #270)
Changed
- Server-side copy unified: 14 native providers migrated from the legacy server_copy to server_side_copy; the multipart trait is documented as NotSupported-by-design on the remaining 8.
- Snap Store listing description refreshed.
Fixed
- CLI security audit (Codex + Opus, parallel then joint): closed the merged release-gate findings (W0/W1) and a second-pass follow-up (W0.6) across every destructive and agent-facing surface:
- Atomic download failure no longer deletes a pre-existing target file (get/pget).
- sync --delete refuses to run from an incomplete or partial directory scan, including a --from-reconcile plan produced from a partial reconcile; a default delete cap bounds the blast radius.
- The CLI remote-path resolver and the serve, speed and benchmark commands reject .. traversal and null bytes (exit 5) instead of operating on a substituted or escaped path.
- rm -r, sync --delete and the dedupe destructive modes fail closed in non-interactive (non-TTY) use without an explicit confirmation flag.
- MCP tool errors are scrubbed of API keys and bearer tokens before entering model context; the MCP line reader is bounded; debug snapshots redact secrets.
- Agent profile lookup is deterministic on duplicate names, accepts numeric selectors, and applies provider options; discovery output emits stable protocol lists.
- Roughly forty findings closed with new unit tests and a live read-only matrix.
- macOS 26.5 Tahoe no window (#290): a borderless main window could not become key, leaving only a Dock icon after the splash; the window now presents via an overlay title bar. (@alexhorner, #290)
- Dev/release data isolation (#302): debug builds use a sibling data root and -dev keyring accounts, with a release-only non-destructive migration, so a development run can no longer read or corrupt the released app's credentials. (@raelb, #302)
- DAG transfer audit: two patch sets correcting the multipart threshold (and growing the chunk when the part count clamps), an AIMD deficit race, a multipart commit leak, parallel-part dispatch, Nextcloud parallel chunks and chunked-v2 threshold (256 MiB), the Azure 

[4.0.2] - 2026-06-04
Cross-Machine Keystore Portability & Agent-Facing Polish
Makes a multi-user keystore backup open correctly on a second computer, makes the
import reversible and legible, and lands the agent-breaking CLI/MCP fixes.
Added
- Portable passphrase-less accounts: a keystore backup now carries a transport-wrapped key (Argon2id over the backup password) for each passphrase-less user partition, and the import re-keys it to the local device. An account that previously showed an empty "My Servers" after a cross-machine import now populates correctly.
- Repair multi-user data: a Settings panel that proactively detects accounts whose data key is bound to another machine and rebuilds them from this device's saved servers, always taking a timestamped snapshot first.
- Reversible keystore import: the import snapshots the existing user_partitions.db to a timestamped .bak before overwriting it, and a post-import summary modal surfaces the restart prompt, cross-machine re-key counts, and the snapshot path instead of a transient toast.
- Lean MCP list_servers: aeroftp_list_servers returns lean identity fields by default; pass include_capabilities: true to embed the full per-profile transfer-capabilities block. A vault of 80+ servers no longer overflows the agent tool-result cap on the default call.
Fixed
- MCP error readability: S3, WebDAV, and Azure XML error messages no longer leak '/&/< into JSON error fields; the final error formatter now emits raw UTF-8.
- Quiet JSON output: the path-resolution Note: line is now silenced in --json mode, matching the profile banner and Next: hints, so a machine-readable run stays quiet on both streams.
Changed
- Settings backup table: the legacy "Other Apps" and "Import Any" rows collapse into a single "Bridge" row with a FILE FORMAT column listing the supported export extensions.
- i18n style: replaced roughly 2024 em-dashes with ASCII hyphens across all 47 locale files (punctuation only, no meaning change).
- Dependencies: chrono 0.4.45, log 0.4.32, reqwest 0.13.4 (non-pinned patch updates).
- Merged wishlist slice 2/3 from main: OpenDrive Native API header label, MEGAcmd real-quota storage handling, Manage Users avatar edit, and switching the active user from the interactive profiles -i loop.
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[4.0.1] - 2026-06-04
S3 AssumeRole, AeroVault Audit Hardening and Settings Consolidation
This patch release pairs a new S3 connection mode with a round of security
hardening and cleanup. It adds native AWS STS AssumeRole support for S3 (#301),
lands the remediation from the AeroVault dual-independent audit, unifies the
profile-bridge legacy clients, folds the redundant Servers settings tab into the
Backup interoperability table (#270), and ships the first batch of community
wishlist items (#300). It also closes a silent download-corruption edge case on
embedded rsync servers such as WD MyCloud.
Added
- S3 native AssumeRole (#301): connect to S3 by assuming an IAM role. Set a
Role ARN (plus optional External ID, session name, duration and MFA) and the
access keys become base credentials that AeroFTP exchanges for temporary,
role-scoped credentials via AWS STS at connect time, then signs every request
with them. The temporary credentials are re-assumed automatically before they
expire, so long browsing sessions and large multipart uploads never fail with
an expired token. Built on a hand-rolled STS client (a single SigV4-signed
AssumeRole POST, no AWS SDK dependency) feeding the existing data-plane signer.
Also accepts an externally supplied session token for credentials already
obtained from STS or SSO, emitted as x-amz-security-token on signed requests
and presigned URLs, both covered by the signature. Shown only on the generic
S3 tile; long-term IAM keys are unaffected. Co-authored with the reporter
(kennysliding).
- Import before password: the .aeroftp import now loads the file before
asking for the decryption password (KeePassXC pattern, #214/#300).
- Open any plain-text file in the editor directly from the preview pane.
- CLI: an --access privacy flag for put/mkdir (#252), a # reorder
command in the interactive profiles shell, and a 2FA prompt on interactive
master unlock.
Changed
- Profile bridge unified: rclone, WinSCP and FileZilla import/export now run
through the single generic dispatcher and panel, with no loss of features.
- Settings consolidation (#270): the redundant "Servers" tab is folded into
the "Backup" tab as an App / Format / Import / Export interoperability table;
the Full Backup row reveals the keystore panel inline.
- rclone: remotes are listed in a stable alphabetical order, and
Nextcloud/ownCloud DAV roots are appended correctly on export.
- macOS: per-architecture DMGs built from a universal2 binary.
- Transfer: DAG engine audit fixes and a corrected Nextcloud chunk
threshold (#288).
Fixed
- AeroVault dual-audit remediation: closed the High-severity findings from
the independent crypto/container audit (extract symlink write-through escape,
reserved-key filter on credential read and delete, v1 format labeling) plus
the remaining tranche-2 items. AeroVault crate hardened to v3 (0.4.x).
- Download integrity on embedded rsync servers: some embedded rsync
firmwares (e.g. WD MyCloud) close the SSH channel before the trailing protocol
marker, which the delta-sync path could accept as a clean end and commit a
truncated file. The delta download now validates the reconstructed size
against the remote file list and transparently falls back to the classic SFTP
download on any shortfall, so a partial transfer can never overwrite the
target with corrupt data.
- Profile duplicate keeps stored credentials: duplicating a saved server
profile now copies its stored password or token regardless of the
save-credentials flag, so the copy connects without re-entering the secret.
- TOTP throttle persistence: the vault 2FA lockout counter now survives
restarts, with a replay guard and a bounded vault read.
- Security dependency hardening: tmp bumped to 0.2.7 for the path
traversal fix (CVE-2026-44705), codecov-action bumped for the
template-injection fix, plus routine dependency bumps.
Removed
- The legacy dedicated rclone/WinSCP/FileZilla Tauri commands and the duplicate
Settings "Servers" tab, now superseded by the unified 

[4.0.0] - 2026-05-27
Shaped Graph Transfer (DAG) and Multi-User Account Partition
v4.0.0 lands two architectural shifts in the same release.
The first is the promotion of the ready-frontier DAG transfer engine introduced in v3.8.4 to the single production path for every transfer surface. The three rollout flags that gated the engine during the v3.8.x cycle are gone, the hand-rolled JoinSet batch orchestrator has been deleted, and the shaped builders are now the single source of truth for every graph the executor schedules: single-file leaves, multi-file batches, sync sessions, intra-file segmented downloads, and cross-bucket copies. The release introduces a principled trait expansion on StorageProvider so the engine can dispatch the right shape per call from a provider's TransferCapabilities, ships the wiring + integration tests that prove the shapes work against live S3, B2, WebDAV, Azure, ImageKit, Google Drive, Dropbox, OneDrive, Box, MEGA, pCloud, kDrive, OpenDrive, Yandex Disk, Jottacloud, Drime, Uploadcare, Cloudinary, and Filen, and pairs the architectural shift with a power-user CLI surface that exposes 25+ runtime knobs over the same engine.
The second is the Multi-User Account Partition: the vault splits into per-user partitions while remaining fully backward-compatible with single-user installs. A boot-time Account Lock Screen presents the configured users, the vault is partition-aware end-to-end (server profiles, AeroSync settings, CLI --user flag), and an admin role with a self-or-admin gate plus an admin reset-passphrase backend rounds out the surface. Migration from a v3.8.x single-user keystore is automatic and idempotent, the admin role is opt-in with a last-admin guard, and the unlock prompts use honest crypto-stack labels (Argon2id key derivation, AES partition encryption). Sixteen commits cover the partition foundation, the boot picker, the CLI --user flag across profile and transfer commands, the cross-user dedup probe with HMAC keying, the migration of every existing keystore consumer (ConnectionScreen, SettingsPanel, IntroHub, ExportImport, KeystoreWizard, Cloud, SavedServers, App.tsx), the admin role, and the UX polish (logout, perceptible unlock spinner, refined L2 picker).
What's new
Capability-aware shape per transfer
The shaped graph builder picks the transfer-core shape per call from the provider's capability snapshot:
- Native multipart upload fan-out on S3, Backblaze B2, Google Drive, Dropbox, OneDrive, and Box: an upload above one preferred chunk now produces N UploadPart graph nodes (one per chunk). The runner orchestrates the lifecycle end-to-end. Per-provider live validation: Drive 500 MiB in 34.6 s (63 parts x 8 MiB), Dropbox 500 MiB in 54.2 s (63 parts x 8 MiB concurrent), OneDrive 500 MiB in 63.8 s (50 parts x 10 MiB sequential), Box 100 MiB in 24.6 s (13 parts x 8 MiB, SHA-1 per chunk + whole-file SHA-1 commit).
- Server-side copy on every backend that advertises the capability: S3 x-amz-copy-source, B2 b2_copy_file, WebDAV RFC 4918 COPY, ImageKit copyFile, plus 14 other native providers. The shaped-copy graph collapses to a single ServerSideCopy node that reserves only an api_slot: no file slot, no disk I/O, no local host bytes. The server moves the data. S3 sources above the 5 GiB CopyObject limit fan out into parallel UploadPartCopy requests (T-DEBT-08).
- Intra-file segmented downloads through the shared shaped_ranges builder: when a provider proves it honours HTTP Range, the segmented download fans out into N DownloadRange nodes with no inter-segment dependencies, governed by the shared chunk / HTTP / disk-write budget.
For users on backends that advertise none of these capabilities the engine degrades honestly to the same single-transfer-core path that shipped pre-v4.0.0, byte-identical with the legacy provider.upload / provider.download.
Provider trait expansion
Five new methods extend StorageProvider:
- begin_multipart_upload(remote_path, total_size, content_type, local_source_pat

[3.8.5] - 2026-05-23
AeroSync Unification, FTP Reliability and DAG Engine Foundation
v3.8.5 is a consolidation release on top of v3.8.4. It collapses the three legacy sync surfaces (the standalone Sync panel, the AeroFile compare dialog and the Sync Presets entry) into a single unified AeroSync panel with three tabs that share state, lands four reliability fixes on the FTP transfer path, closes the cross-platform AeroRsync Z.4.3.f6 deadlock, and stages the foundation for a new shared transfer execution engine (default off, behind environment flags). It also picks up the v3.8.4 follow-ups: a pCloud WebDAV registry preset, an optional Filen CLI API key to skip 2FA on reconnect, a WebDAV User-Agent fingerprinting fix, and the OAuth refresh-token re-auth fix for Google providers.
What's new
Unified AeroSync panel
The three previously disconnected sync surfaces collapse into one AeroSync dialog with three tabs: Compare, Plan and Sync. The same dialog covers local-to-local pairs, local-to-remote pairs and remote-to-remote pairs (with a connected profile), backed by a shared in-process runner and a recursive compare scan that uses each provider's native listing instead of a folder-by-folder walk. The Plan tab carries the Speed mode and Verify policy knobs (including Maniac), the retry/budget/versioning controls, the canary mode with keep-both rename execution, and a bandwidth control row. The Sync tab now ships a per-file results table. Journal History and the Scheduler are launched from inside the unified panel, and journal resume is wired into the Sync tab UI. The toolbar entry point and the F4 shortcut both open this same dialog.
The previous Local Sync, Compare Panels and Sync Presets View-menu entries have been removed.
Provider-native recursive compare scan
The Compare scan now uses each provider's native recursive listing where one exists (S3 ListObjectsV2, Azure flat listing, Dropbox list_folder recursive, Filen tree, GDrive q=trashed=false with parents traversal, OneDrive children pagination, B2 b2_list_file_names, MEGA tree, pCloud listfolder recursive flag, koofr/kdrive recursive, OpenDrive list-tree, OAuth providers' batch listing), and falls back to a depth-bounded BFS walk on protocols that do not. Compare results are now exportable as JSON or CSV. The deepest-first ordering of recursive deletes prevents "directory not empty" failures on remote backends.
Bandwidth, scheduler and canary in one place
The unified panel surfaces the bandwidth control row directly in the Sync tab, the Scheduler launcher inside the panel header, and a canary mode that runs a single representative file first and confirms before committing the full batch. Canary uses the keep-both rename strategy on conflict so the source side stays untouched until the user accepts.
FTP transfer reliability
Four user-visible FTP fixes:
- The FTP clone-pool upload path now dials the connection before reading credentials, eliminating a class of "command not connected" failures on parallel uploads.
- The resume-download path and the in-memory read_file path on FTP both dial first, fixing intermittent zero-byte downloads and empty Properties previews on cold pools.
- AeroSync now routes FTP transfers through the provider API instead of the bare-protocol path, so the bandwidth limiter and the retry policy apply identically to FTP and to cloud providers.
- A panicking local scan inside the DAG sync path is now caught and surfaced as a structured SyncError instead of aborting the entire sync.
pCloud WebDAV preset
A pcloud-webdav registry preset is added (email + password, port 443, https://webdav.pcloud.com for US accounts, https://ewebdav.pcloud.com for EU accounts). Setup instructions cover the data-region split and the first-connection "New login attempt" confirmation email. The storage dedup layer recognises a pCloud WebDAV profile and a pCloud OAuth profile sharing the same email as a single account.
The preset is picked up automatically by the Discover panel and

[3.8.4] - 2026-05-20
Unified Transfer DAG, Staging Queue and AeroFile Sync
v3.8.4 is a big release: the slow work of the last cycle was converging every transfer surface (GUI, CLI, AeroSync, cross-profile) onto one shared execution engine, building a staging queue on top of it, shipping a CLI dispatcher set, unifying three disconnected sync dialogs, and acting on the v3.8.3 community feedback. Seventy commits since v3.8.3, organized below.
What's new
This section is the high-level tour. The detailed lists below cover every change.
A single DAG transfer executor
AeroFTP had multiple parallel transfer paths: the GUI segmented download, intra-file range downloads, cross-profile transfers, the AeroSync engine, the CLI pget and sync commands, and the legacy per-protocol code. v3.8.4 lands a ready-frontier executor over a Directed Acyclic Graph (DAG: every transfer is a graph of nodes where each edge says "this step depends on that one", and the executor walks the graph fanning out as soon as a node's dependencies are satisfied), and progressively converges every one of those paths onto it. The same code now powers concurrent-range downloads for SFTP and FTP, B2 large-file uploads, cross-profile transfers, and the AeroSync download stage. The executor ships with prudent AIMD backpressure (Additive Increase, Multiplicative Decrease: the classic TCP-style self-tuning that ramps up while the link is healthy and backs off hard at the first sign of strain) so it adapts to the slowest link without the user having to pick a number, and an AppHandle-free observability sink so non-Tauri callers (CLI, agents, tests) get the same progress signal the GUI does.
This is mostly internal plumbing. The user-visible effect is that the GUI and the CLI now use the same path for large transfers, with the same parallelism, the same backpressure, and the same telemetry. The GUI grows a Settings knob for the download segment count when you want to override the heuristic.
Transfer Queue with real staging
The unified planner had a queue, but it was effectively a fire-and-forget list. v3.8.4 turns it into a proper staging queue: items land first as staged (with their pre-enumerated tree for FTP and SFTP), an explicit dispatcher moves them to pending when they are ready, and an Auto-start setting decides whether they go automatically or wait for a manual Start. The CLI gains an agent peek view of what is currently staged or pending. The transfer toast was demoted to a minimized indicator so the queue panel is the source of truth.
Command-line surface, feature-complete
v3.8.4 closes the long-running CLI work and pushes aeroftp-cli to 69 top-level subcommands across listings, transfers, syncing, vaults, profiles, hashing, agent operation, batch scripting, mount and packaging. With this release the CLI is feature-complete for everyday workflows: anything the GUI can do on a file or a server is reachable from the command line, and the same shared transfer engine now powers both surfaces so the throughput numbers no longer drift between them.
The release adds:
- rmdirs: recursive prune of empty directory trees, the missing companion to rmdir from v3.8.2.
- agent peek: a read-only view of the current transfer queue (staged + pending) for agents and automation. The agent-info subcommand also surfaces the transfer count and queue depth now.
- CLI dispatcher binary: a thin dispatcher that routes Linux deb / rpm / AppImage packages and Windows installs through a stable entry point, ported to Windows with proper detach+wait semantics. The set-of-four packaging slots (deb / rpm / AppImage / Windows) are now all wired to it, with R10 / R11 / R13 regression gates in CI.
- aero alias toggle: a one-command toggle to install or remove the short aero invocation, so aero get s3://bucket/file.tar Just Works.
- --max-transfer enforcement on the converged shared transfer path, so a global byte cap now applies uniformly to CLI runs, GUI runs, and AeroSync.
- Transfer capability disc

[3.8.3] - 2026-05-18
Critical Linux Hotfix
v3.8.2 shipped a Tauri 2.11.1 dependency bump that made every Linux build non-functional: the production webview origin was reclassified as remote and all backend commands were rejected, leaving the app unable to list files, read the credential vault, connect, mount drives or check for updates. Windows and macOS were unaffected. This release restores Linux operation and bundles the related vault and edit-screen fixes.
Added
- Drag-and-drop profile import: Drag a client profile or configuration file directly onto its Profile Bridge import form to bring it in, instead of browsing for it.
Fixed
- Linux app fully non-functional on v3.8.2: Pinned Tauri back to the known-good 2.11.0 so the production webview keeps backend access. Every Linux v3.8.2 install was affected; upgrading is strongly recommended.
- Saved-server passwords blank in the edit screen: The edit form now reads the stored password from the vault unconditionally, matching the connect path, so credentials appear after the server list is rebuilt from the vault.
- Server list empty after a storage-cache cleanup: The list is rebuilt from the encrypted vault when the local cache is missing instead of showing zero servers.
- Keystore backup and import: Corrected the local backup whitelist key names and routed a double-clicked .aeroftp-keystore file straight to the import screen.
- Provider mode tabs while editing: Locked read-only during profile edit to prevent accidental protocol changes.
- AeroFile initial panel: Starts on a single left panel and never lists with an empty path.
Changed
- Parallel transfers: SFTP gains a connection pool for concurrent multi-file transfers and intra-file concurrent byte-range reads, with concurrent ranged reads also applied to WebDAV and Koofr. The GUI and CLI now share one concurrent executor, and CLI recursive, glob and upload transfers run on it for faster large and multi-file operations.
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.8.2] - 2026-05-17
Profile Bridge Expansion, Server-Side Hashing and Interop Fixes
The profile bridge grows from three sources to fifteen, with the twelve new sources now fully wired into the Export/Import dialog (not just the CLI). This release also lands the server-side hashing work and a batch of cross-tool interoperability fixes.
Added
- Profile bridge: 12 new sources in the GUI: the Export/Import dialog now lists all fifteen bridge sources. Beyond rclone, WinSCP and FileZilla you can import from and export to AWS CLI, MinIO Client, s3cmd, OpenSSH, PuTTY, MobaXterm, lftp, Cyberduck, Dreamweaver, Kopia, restic and Duplicacy. Each source auto-detects its conventional config path, recovers credentials into the AeroFTP vault where possible, and shows a clear per-source note when only metadata or partial secrets can be carried.
- Export filtered by protocol support: when exporting to a target tool, profiles whose protocol that tool cannot carry are shown disabled with an explicit reason and excluded from the written file, so an export never produces an unusable entry.
- Server-side file hashing: a Properties checksum tab for remote files, with server-side hashes exposed for S3, Backblaze B2, Google Drive, OneDrive (quickXor), Box, Dropbox and SFTP. The CLI hashsum and lsjson commands prefer server-side hashes and avoid downloading, plus a new stable-JSON lsjson listing command and additional listing and maintenance commands (size, lsd, lsl, lsf, purge, rmdir).
Fixed
- WebDAV path handling: reserved path characters are now encoded and the auto-detected collection root is applied; collection requests are normalized to trailing-slash form.
- SFTP listing: entry type is recovered via stat when a server omits attributes during listing.
- rclone export: remote names are conformed and SFTP key material is exported correctly; exported S3 config objects are addressed bucket-relative.
- AeroCrypt interop: overlay filename encoding aligned for cross-tool compatibility.
- CLI vault extract: a trailing-slash destination is treated as a directory.
- MCP server: OAuth providers are kept on a fresh token in the long-running server.
Changed
- Profile bridge core: a single shared module now backs every importer (UUID, S3/WebDAV provider tables, INI/plist/XML scanners, atomic 0600 writes), with the per-source protocol filter and export format shared between the GUI and the CLI so the two never diverge.
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.8.1] - 2026-05-16
Two New Themes, Toolbar Legibility and Quota Polish
A UI polish patch on top of v3.8.0: two new application themes, a toolbar contrast fix, a form-header width tweak, and the manual storage-quota auto-scan fix.
Added
- Ice theme: a light icy white-blue palette for a calm, frosted look. Wired through the full theme system (CSS palette, theme cycle and toggle, Monaco editor, xterm.js terminal, Settings selector, Activity Log, icon-theme defaults).
- Red Lava theme: a brilliant crimson red on near-black. The titlebar and status bar render as glowing-red chrome (the status bar a touch darker than the titlebar for depth) while panels and cards stay dark; every titlebar icon is forced to white for contrast. The total number of themes goes from six to eight.
- Theme name and description translated across all 47 languages.
Fixed
- AeroVault and AeroCrypt toolbar buttons: now inherit the same bright foreground as the Sync and Refresh buttons instead of a dimmed grey, so they are clearly legible in their inactive state.
- Manual storage-quota auto-scan: now runs on connect for profiles that opted in, even when only a manual total is present or a WebDAV/SFTP backend returns a partial quota; saved-server cards reflect an updated quota immediately without a manual reload.
Changed
- Provider form header subtitle: given more width so longer one-line descriptions (for example Backblaze B2) no longer wrap unnecessarily.
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.8.0] - 2026-05-15
AeroVault Wrapper-Stack, Behind-the-Scenes Telemetry, AeroRsync Streaming and Dual-Panel Unification
A large release across three fronts: the AeroVault v3 wrapper stack gets real small-file packing and a behind-the-scenes technical receipt, the native AeroRsync engine ships streaming and enabled by default, and the AeroFile dual panel grows endpoint-aware unification. It also lands the v3.8.0 wishlist batch and the CLI profile-management fixes from issues #194, #195, #196 and #180.
The AeroVault wrapper-stack design (the compression -> chunking -> crypt -> error-correction pipeline, the wrapper-vs-step taxonomy, the corrected AES-256-GCM-SIV avalanche framing, algorithm versioning as a forward-compat clause, and the small-file-packing model) is a sustained community design contribution by Ehud Kirsh in the COMMUNITY ROADMAP thread (#162). The wrapper-stack hardening and telemetry land in commits 406e273c (engine), abad0cba (receipt UI plus 47-language i18n) and ed01fbe3 (CLI vault subcommand documentation). Credit is inline in every receipt and in the architecture primer.
AeroRsync Native Streaming, Session Reuse, Default ON, and Local-to-Local Sync
This release closes the P3-T01 cap and the Track Z.1 + Z.2 AeroRsync/AeroFile convergence work (internal roadmap APPENDIX-Z). It is the first release where the native rsync delta-sync engine ships enabled by default on fresh installs and no longer caps file size at 256 MiB.
Streaming end-to-end. The upload and download paths now stream delta plans through iterator-style state machines (send_delta_phase_streaming on the upload side, apply_delta_streaming + StreamingAtomicWriter on the download side). The 256 MiB in-memory cap that previously gated multi-gigabyte files is gone. A 4 GB cold upload and a 4 GB file re-synced after a 5% mutation both completed end-to-end against a real WD My Cloud NAS over residential SSH (862s / 846s wall clock respectively), confirming feature parity with the wire protocol and headroom for arbitrary file sizes. The writer ensures kill-9 safety by writing to a .aerotmp temp file and renaming atomically on completion.
Batch session reuse. Multi-file batches now share a single SSH session via AerorsyncBatch. A 100-file batch (1.1 MiB each) against the Docker fixture archives delta_session_count = Some(1) and a 99.45% savings on the second pass. The session-pool spec keeps short-lived sessions to side-step long-running NAS embedded-SSH lock-ups, and the new delta_session_count / delta_bytes_on_wire fields are surfaced in SyncReport, plumbed into the AeroSync UI as syncPanel.deltaBatchSummary and syncPanel.deltaBytesOnWire, and translated across all 47 locales.
Host-key pinning symmetric across transports. Classic SFTP (libssh2) and native probe (russh 0.57) now use the same AERORSYNC_HOST_KEY_ALGS ordering (Ed25519 → ECDSA → RSA SHA-2). Previously the two transports could land on different host keys when a server exposed multiple, which produced a fingerprint mismatch during pin verification. Both transports now publish identical preferences via session.method_pref (libssh2) and russh::Preferred.key (russh).
Default ON. load_native_rsync_enabled() now returns true when no config file exists. Existing installs with a TOML config keep their stored choice (no breaking change). Users on a fresh boot get the native delta engine automatically; the legacy classic SFTP path remains opt-in via Settings > Sync > Use native rsync = off or by editing the config.
Wire preamble robustness. A 2 to 3% hard-rejection rate on high-cardinality batches (≥ 50 files over a single SSH session) was traced to read_u8_len_prefixed_ascii returning InvalidAlgoListLen (terminal) when the SSH read chunk happened to end exactly on a length byte of the algo list. The parser now returns TruncatedBuffer { needed, available } (recoverable), letting the preamble exchange loop continue reading. Two regression unit tests pin the behaviour, and the Z.1.1 KPI batch test now 

[3.7.9] - 2026-05-11
AeroFile Dual Panel (Slice A) and AeroVault v3 (Experimental)
A feature release with two large additions and the usual fix sweep.
AeroFile Dual Panel ships Slice A of T-DUAL-PANEL-UNIFICATION (issue #162 section 2). AeroFile mode can now show two local panels side by side, with full keyboard parity on the second panel: F2 / Delete / Enter / Backspace / Ctrl+A / Ctrl+C / Ctrl+X / Ctrl+V / Ctrl+R / Ctrl+F / Space (Quick Look) / Alt+Enter (properties) / arrows / Shift+arrow / Home / End all route to whichever panel has focus, and Tab cycles between the two local panes. New Total-Commander-style shortcuts: F5 copies the current selection to the other panel, F6 moves it, F7 creates a folder in the focused panel. The split is resizable from mouse and from keyboard (Arrow Left/Right to shift the ratio, Home/End to jump to the extremes, Enter/Space to reset to 50/50, with aria-valuenow and tabIndex=0 on the separator). Drag-and-drop between the two panels uses the existing rename_local_file / copy_local_file backend; Ctrl+drag switches from move (default) to copy. The two local tab strips are unified in the top tab bar with L / R markers. Toggle via the Columns icon in the toolbar or Ctrl+Shift+D, persisted to localStorage. Slice B (each pane configurable as local or as a saved remote profile) and Slice C (compare / mirror / backup / bisync workflows on top) follow in their own release windows.
AeroVault v3 (Experimental tier) lands as a draft container format alongside v2. v3 uses content-defined chunking (gear-CDC) before compression so dedup and future AeroSync range semantics stay chunk-aligned, then per-chunk zstd at one of three profiles (fast / balanced / archive = zstd -3 / -9 / -19), then AES-256-GCM-SIV (RFC 8452, nonce-misuse-resistant) per chunk with a 96-bit random nonce and per-chunk AAD bound to the block index and chunk id, then a manifest encrypted with the same cipher. Chunks are content-addressed by BLAKE3 keyed-128 (the chunk id, 16 hex bytes, also used as the dedup key) and integrity-checked by BLAKE3-256 (the cipher hash, pre-decryption integrity for the future ECC layer). Argon2id with m=128 MiB, t=4, p=4 derives two distinct KEKs (encryption + MAC) via HKDF; both KEKs unwrap independent random 256-bit working keys through AES-KW. The 1024-byte header carries an HMAC-SHA512 tag verified before any unwrap. The header reserves an extension directory and an extension payload region so a future v4 reader can append Reed-Solomon / Parchive-style error-correction blocks without changing the header or manifest layout: this implements the v3 + ECC = v4 forward-compat contract requested in the #162 thread. v2 vaults remain the default; v3 is opt-in by selecting the Experimental tier in the create dialog, and there is no automatic v2 → v3 migration in this release. Full specification: AEROVAULT-V3-SPEC.md.
The release also closes the TOTP passthrough point raised in issue #128 for Filen and MEGA (persisted base32 secret derives the 6-digit code on every reconnect, removes the manual prompt), surfaces the response body on MEGA HTTP 402 to make the cronic "session expired or invalid" path actionable, eliminates the empty-state flash in the IntroHub Saved Servers tab on connect/disconnect cycles, and finalizes Activity Log coverage with privacy redaction across the DebugPanel buffer.
Added
- AeroFile Dual Panel — Slice A: two side-by-side local panes with full keyboard parity, Total-Commander F5/F6/F7 shortcuts, unified tab bar with L/R markers, drag-to-copy/move between panes, keyboard-operable resize separator, blue/amber focus rings, persisted split ratio.
- AeroVault v3 (Experimental): gear-CDC chunking, zstd profiles fast/balanced/archive, AES-256-GCM-SIV per chunk, BLAKE3-128 chunk id + BLAKE3-256 cipher hash, Argon2id-derived KEKs (encryption + MAC) via HKDF + AES-KW, HMAC-SHA512 header MAC, reserved extension directory + payload region for the future v4 ECC layer. Draft spec in docs/AEROVAULT-V3-

[3.7.8] - 2026-05-11
Full Keystore Backup v2 with zstd Compression, Security Audit Closure, and CLI Parity
A security and infrastructure release. The .aeroftp-keystore format is now a complete, single-file application snapshot (vault entries, the five managed SQLite databases ai_chat, agent_memory, file_tags, vault_history, speedtest_history, the plugins/ and sync_snapshots/ trees, plus a 21-key whitelisted localStorage block): encrypted with the same Argon2id / AES-256-GCM envelope as before, now compress-then-encrypted with zstd level 19. A typical power-user backup drops from ~20-25 MB to ~5-7 MB. Backups produced by earlier releases (v1, vault-only) still import unchanged via the legacy no-codec path.
The format and the surrounding code went through a two-pass code review (two independent LLM reviewers: Claude Opus 4.7 and GPT-5.5) and every high/medium/low finding raised was addressed before release. The hardening sweep landed alongside the format change: an authenticated copy of the metadata embedded in the encrypted payload and verified before any disk write, binary fields emitted as base64 strings instead of JSON byte arrays (eliminates a 3.6× pre-zstd memory bloat that would have OOM'd 32-bit Windows builds on a large chat-history dump), bounded zstd decompression with a 2 GiB ceiling that rejects compression bombs, a size cap on the backup file before it touches RAM, atomic writes through O_EXCL tempfiles to close a symlink-race vector, AES-GCM nonce and salt validated before the cipher sees them, SQLite snapshots captured via VACUUM INTO from a read-only connection so the live DB is never mutated, restored plugin scripts come back with the executable bit set (the previous code path lost it silently and broke the plugin loader after every restore), and the import result carries a requires_restart flag because a Linux/macOS rename underneath a live app.manage(Mutex<Connection>) strands the imported state on an unlinked inode and a Windows rename outright fails with sharing-violation. Argon2id and zstd now run on a blocking worker so the Tauri runtime stays responsive during a restore.
The new CLI subcommand aeroftp-cli keystore export|import|info mirrors the GUI's Settings > Backup surface, so backups can be scripted into cron and CI pipelines with structured JSON output, --password-stdin and AEROFTP_KEYSTORE_PASSWORD env-var resolution that keeps passwords out of ps, per-section --skip-* selectivity, and exit codes matching the rest of the binary (0 success, 2 file not found, 6 auth failure, 7 unsupported version, 11 I/O, 99 unclassified).
Added
- Full keystore backup v2 (#178): single-file snapshot of vault entries + 5 SQLite DBs + plugins + sync snapshots + 21-key localStorage whitelist. Encrypted with Argon2id (128 MiB, t=4, p=4) + AES-256-GCM. v1 backups still import unchanged.
- zstd level 19 compression promoted from optional (gated on the aerorsync feature) to a default dependency. Compress-then-encrypt order; ~500 KB binary cost. Removes the conditional and lets future AeroVault v3 work rely on the codec always being linked.
- Two-tier export contract: full (vault + SQLite + plugins + sync snapshots + localStorage) and vault-only (slim, vault entries only, same as pre-v3.7.8 v1 export). UI radio group in Settings > Backup; CLI --mode flag.
- Authenticated metadata embedded inside the encrypted payload of new v2 exports and verified before any disk write. Previously the cleartext envelope metadata was the only copy and could be tampered with by anyone who had the file at rest. Pre-password preview still uses the cleartext copy with a documented note that it is not cryptographically trusted before decryption.
- aeroftp-cli keystore export|import|info: CLI parity with the GUI Settings > Backup surface. --json machine-readable output, --password-stdin and AEROFTP_KEYSTORE_PASSWORD env var to keep passwords out of ps, per-section --skip-vault / --skip-sqlite / --skip-files / --skip-local-storage flags for partial 

[3.7.7] - 2026-05-10
Benchmark Trash Purge, AeroFile UX Polish, and Windows Update No-Trace
A consolidation release. The original benchmark trash-purge work (still detailed below) ships alongside a sweep of file-browser UX papercuts surfaced in #178, the no-trace portable update and per-user file associations on Windows (#176), and a handful of provider polish items.
Added
- Dedicated MIME-style icons for AeroFTP file types so .aerovault, .aeroftp and .aeroftp-keystore render with their own document icons in the file list and in the host file manager.
- App version in the window title and Help menu, so users can see at a glance which build they are running.
- Folder drill-in spinner (#178 #2): both Remote and Local panels now show a soft overlay spinner while a directory listing is in flight. Debounced via a fadeInDelayed keyframe (opacity 0 for the first ~250 ms of a 450 ms animation) so fast listings never reveal the spinner. Honours prefers-reduced-motion.
- Per-panel Up button (#178 #3): Up has moved from the global toolbar into each panel's path bar (next to the existing refresh icon) so the affordance is unambiguously bound to the panel it operates on. Works in both AeroFile mode and dual-pane.
Changed
- Parent folder row navigates on single click (#178 bonus): the legacy .. row required a double-click, inheriting the FileZilla / WinSCP convention. Selecting a Parent row was always a no-op (you cannot download, delete or rename a parent entry) so single-click is strictly better.
- Self-extracting auto-update artifacts stage outside ~/Downloads/ (#176): portable .zip and .AppImage now stage into a private cache directory ($XDG_CACHE_HOME/aeroftp/updates/ on Linux, ~/Library/Caches/aeroftp/updates/ on macOS, %LOCALAPPDATA%\aeroftp\updates\ on Windows). Installer formats (msi/exe/deb/rpm/dmg) keep ~/Downloads/ because they ARE the artifact, useful to re-run, copy to USB, hand to a colleague. The Windows portable cmd helper also wipes the staged ZIP, the sigstore sidecar and the temp extraction dir after the swap so the "portable" no-trace contract is honoured. The Linux AppImage install drops the staged source archive after copying it into the running install location.
- WebDAV setup example shows the full URL with https:// scheme (#175 follow-up): the previous example "Example: cloud.example.com/remote.php/dav/files/user/" omitted the scheme the server field actually requires, so users would copy-paste a URL the backend then rejected. The placeholder is now hardcoded as a technical example; only the surrounding "Example:" label stays translated.
Fixed
- WebDAV reads tolerate a missing TLS close_notify after the full body has been received: some WebDAV servers do not send close_notify after the last byte and the previous behaviour aborted the read mid-stream once Content-Length had been satisfied.
- Trash purge fixes for MEGA, Internxt and pCloud after live tests: final live-test corrections on top of the benchmark trash-purge work below.
- Filen S3 and WebDAV wrapper triage: connections through Filen's S3 and WebDAV bridges work again after a wrapper-layer regression.
- Filen email placeholder key + Tab.digital tabdigital.cloud shard recognition: the email field now displays the correct hint, and the Tab.digital connection screen recognises tabdigital.cloud as a Tab.digital shard for proper routing.
- 2FA detection ordered before the failure log on the saved-server connect path (#128 follow-up): the saved-server flow logged Connection to <server> failed. Check credentials. before checking for the TOTP challenge, so the activity log misled users into thinking the password was wrong when the server was just asking for a 2FA code. The order now mirrors the QuickConnect path: 2FA detection first, log entry becomes auth.enter2FAHint instead of Check credentials.
- Portable AeroFTP no longer overwrites the installed app's vault keyring entry: portable builds now use a separate vault-passphrase-portable slot under the same KEYRIN

[3.7.6] - 2026-05-08
Hotfix: restore IPC after Tauri 2.11.1 origin-confusion regression
A hotfix release that restores Linux production builds after v3.7.5 shipped a critical regression which broke every IPC call with "Command X not allowed by ACL". Health checks, local file listing and the rest of the application were unable to invoke any backend command. The v3.7.5 GitHub Release, remote tag, Snap stable channel and the open winget submission were rolled back before users could pick up the broken build, so v3.7.6 is the first build a user receives after v3.7.4 unless they manually pulled the v3.7.5 .deb. No user data was lost.
Fixed
- IPC restored on Linux production builds: pinned tauri = "=2.11.0" to avoid the new is_local_url() check introduced by tauri 2.11.1's GHSA-7gmj-67g7-phm9 fix. The check classifies http://127.0.0.1:14321 as a remote origin and rejects every custom command from remote origins unless the app ships a full ACL manifest listing every command. AeroFTP's Linux production build has historically loaded its bundled frontend from the tauri-plugin-localhost loopback server to work around WebKitGTK rendering issues with tauri:// for Monaco, xterm.js and iframes, so the new check broke the entire backend surface. Keeping the existing webview origin intact also preserves every WebKit origin-scoped value on upgrade (localStorage, IndexedDB, master password unlock cache, theme, local tabs, recent paths, server filters, Activity Log entries), so users with established profiles do not see the consolidation Migration Wizard re-fire and lose visibility on entries that require master password unlock.
- Main window creation moved from tauri.conf.json to a programmatic WebviewWindowBuilder in setup(): the URL is now set up-front per platform with no post-creation navigate(), eliminating the previous origin-swap pattern that the future tauri 2.11.x fix will block again and aligning Linux with the splash screen pattern. On Linux production the URL is http://127.0.0.1:14321/index.html directly; macOS and Windows production keep the bundled-protocol default (tauri://localhost/index.html or https://tauri.localhost/index.html); dev mode uses the configured devUrl.
Security
- GHSA-7gmj-67g7-phm9 / CVE-2026-42184 (Tauri Origin Confusion in IPC, MEDIUM 6.1) accepted as not applicable: the CVE vector requires loading remote/untrusted content into a webview to confuse the IPC origin. AeroFTP loads only its own bundled frontend assets, has no remote iframe surface, no remote webview navigation, no WebviewUrl::External to user-controlled URLs, so the vector cannot be triggered on this surface. The pin to tauri = "=2.11.0" is documented in src-tauri/Cargo.toml and src-tauri/.cargo/audit.toml. A full app ACL manifest migration is tracked for a future release that will let us un-pin tauri while keeping the strict origin check active.
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.7.4] - 2026-05-07
Filen reliability, provider polish and Windows Auto-Update parity
Added
- Activity Log is reachable from the View menu: the Activity Log panel is now exposed through the desktop menu, making authentication, transfer and provider diagnostics easier to inspect without hunting through secondary surfaces.
- Media providers are first-class in the UI: media-oriented services added across the recent provider wave are surfaced consistently in provider discovery and navigation so ImageKit, Uploadcare, Cloudinary and related integrations are no longer hidden behind generic cloud categories.
- Cloudinary provider integration: Cloudinary joins the media-provider set alongside ImageKit and Uploadcare, keeping the Home / Add Service flow consistent for image-CDN and media-storage backends.
- Tab.digital provider preset: Tab.digital is available as a Nextcloud-as-a-service preset with EU / GDPR positioning, first-run health metadata and provider-card polish.
- Backblaze B2 usability upgrades: bucket-level quota, share-link UI and a clearer hide-vs-permanent-delete model are exposed so users can recover soft-deleted files instead of treating every delete as final.
- AeroFTP file icons and associations: .aeroftp and .aeroftp-keystore receive dedicated mimetype icons and bundle wiring, matching the existing AeroVault document treatment.
Changed
- Filen Desktop local bridges are first-class: local WebDAV and S3 bridge profiles are treated as intended local integrations instead of fragile custom endpoints.
- Provider HTTP transfers share a 30 minute read timeout: long-running cloud reads now use a unified timeout policy, reducing false failures on large downloads and slow links.
- OneDrive nested mkdir and Drime listing behavior are more predictable: nested folder creation and listing code paths now avoid provider-specific side effects that could surprise users during sync or browse operations.
Fixed
- Filen v3 upload reliability: uploads now use the required 1 MiB AES-GCM chunking model, retry individual chunks when response-body decoding flakes, and open the dedicated 2FA prompt on Filen TOTP challenges.
- CLI / MCP WebDAV profile mapping: saved webdavScheme values now map to tls_mode, so CLI and MCP connections honor the same HTTP/HTTPS behavior as the GUI.
- Nextcloud / ownCloud WebDAV navigation: drill-down and URL-bar population are fixed for WebDAV providers that expose Nextcloud / ownCloud style paths.
- Benchmark privacy and shell behavior: aeroftp-cli benchmark sanitizes PII before assertions and ignores SIGPIPE during sweeps, preventing noisy failures when output is piped.
- Provider preset polish: Tab.digital no longer carries stale basePath / contactVerified defaults, the IntroHub card detects its WebDAV variant correctly, and related OCS badge colors are aligned.
Windows Auto-Update parity (MSI silent, NSIS silent, Portable in-place)
Added
- Portable Windows ZIP becomes a complete portable build (#176): the AeroFTP-X.Y.Z-portable-windows-x64.zip artifact previously contained only AeroFTP.exe. It now ships with portable.marker, README.txt, and LICENSE.txt alongside the executable. The marker file is the canonical detection signal for portable mode and survives any folder the user picks (USB drive, network share, custom path).
- Portable data directory honesty: when portable.marker is present next to AeroFTP.exe, all per-app data (config, cache, AeroAgent SQLite databases, file tags, vault credentials, plugins, speech models, agent memory, chat history) is written to <exe-dir>\data\ instead of %APPDATA%. Copy the portable folder to another machine and your saved servers, AeroVault, and AeroAgent state come with it. Standard MSI / NSIS installs continue to use %APPDATA% exactly as before, no migration, no behaviour change for existing users.
Changed
- Windows auto-updater installs silently and restarts automatically across all three formats: previously, even when an update was downloaded and Sigstore-verified, the 

[3.7.3] - 2026-05-06
Community Benchmark (Phase 1) + CI / UX fixes
Added
- aeroftp-cli benchmark CLI command: schema-v1 conforming, sanitization-enforced community benchmark across upload, download, list, stat, and delete operations. Four levels are available (quick, standard, deep, custom). Output is anonymized: no hostnames, paths, credentials, usernames, or bucket names are written to the report. See docs/COMMUNITY-BENCHMARK.md and the new Community Benchmark Report Issue template to participate.
- Community Benchmark public guide: docs/COMMUNITY-BENCHMARK.md explains why the dataset exists, how to run each benchmark level, what the JSON report contains, what is never collected, how to submit a report manually, and how the 2-month Phase 2 decision gate works.
- Benchmark report Issue template: .github/ISSUE_TEMPLATE/benchmark-report.yml accepts sanitized JSON reports with coarse region and connection-type metadata, keeping Phase 1 human-reviewed and consent-based.
Fixed
- Windows titlebar: modal close buttons (X) within the upper 36 px were blocked by an overly wide drag region. Drag is preserved by the two explicit child elements (logo + spacer), while interactive controls can receive their first click.
- ImageKit listing rejected by API: the provider was sending type=file-and-folder to ImageKit's /files endpoint, which is not in the API's accepted set (file | file-version | folder | all). Every list call after a successful authentication failed with Invalid configuration: Your request contains invalid value for type parameter. Switched to type=all, which returns the folder + file mix the rest of the provider already consumes.
- ImageKit listing decode error on folder rows: with type=all, ImageKit emits an explicit JSON null for fields that only make sense on file entries (size, tags, mime, fileType, dimensions). #[serde(default)] only fires on missing keys and tripped on null, so the response refused to deserialize against Vec<IkFile> and the connection failed with Parse error: error decoding response body. Added a null_to_default deserializer helper applied to every non-Option field that the API can return as null for folder rows.
- Activity log "Authenticated as htt*"**: maskCredential() was masking provider account identifiers that happen to be public URLs (ImageKit's URL Endpoint ID, Uploadcare's, self-hosted WebDAV / Immich) as the unhelpful three-char prefix. The endpoint URL is not secret. The helper now detects https://... and returns host + pathname unmasked, so the log reads Authenticated as ik.imagekit.io/aeroftp instead. AKIA / email / generic-username masking unchanged.
- benchmark CLI ignored profile initial path: the working directory was anchored at the remote root (/.aeroftp-bench/...) regardless of the profile's initialPath. On read-only roots the benchmark failed before any measurement. Now anchored under the resolved profile base, so cleanup, leak grep and report paths share a single, profile-respecting prefix. Warm-up upload errors are also fatal now, instead of being swallowed into a summary.errors=[] "0 runs" report.
- IntroHub redundant + New button merged into Discover tab (#171): the standalone "+ New" button next to the tab strip and the "Discover Services" tab opened the exact same destination. Reported by @legion1978: two side-by-side controls for one action confused the onboarding instead of clarifying it. The "+ New" button has been removed; the Discover tab is now labeled Add Service (translated in 47 languages) and uses a circled-plus icon to keep the affordance explicit. The Ctrl+N shortcut and the empty-state quick-connect still route to the same tab.
CI
- Snap build: Tauri release binary is now built inside the build-snap job before snapcore/action-build. The job pulls libnghttp2-14 patched against USN-8233-1 from the Ubuntu archive at build time.
- build-snap no longer silently green: dropped continue-on-error from the actual build step and switched the post-build confirm step to fail-

[3.7.2] - 2026-05-06
AeroCrypt overlay, IntroHub & community polish, CLI security hardening, 2 new image-CDN providers
A wide release that consolidates the v3.7.2 community wishlist (#161), promotes the rclone-crypt overlay to a first-class encryption layer next to AeroVault, ships an external GPT 5.5 high audit pass on the CLI / MCP / AI core dispatcher with 17 paired security fixes, adds two new native image-CDN provider integrations (ImageKit and Uploadcare, taking the protocol grid from 22 to 24), restructures the custom titlebar around an explicit 3-cluster layout, surfaces SFTP idle-reconnect transparently, and clears every shippable item EhudKirsh and Tom raised on the wishlist thread. The bundled aerovault crate moves to 0.3.5 (routine maintenance, no format change). Cryptographic primitives are otherwise untouched.
Added
- AeroCrypt overlay (rclone-crypt) as a first-class encryption layer: closes the rclone-crypt overlay (APPENDIX-S) as a first-class layer alongside AeroVault. Folder transfers now traverse encrypted directory trees end to end via two new backend commands (rclone_crypt_provider_download_folder, rclone_crypt_provider_upload_folder) with BFS depth 64 and per-level dirIV resolution. Filename obfuscation (bucket-based, ASCII + Latin-1) is wired through obfuscate_name / deobfuscate_name. A new rclone_crypt_provider_create_remote command initialises the dirIV in an optional subpath. The toolbar gains an AeroCrypt button next to the AeroVault overlay button, the remote path bar shows an AEROCRYPT badge while the overlay is active, and the post-connect banner auto-detects rcloneCryptEnabled from imported configurations. The unlock dialog, renamed "AeroCrypt Rclone Crypt overlay", supports both Open existing and Create new with an obfuscate-filenames toggle. 15 new tests cover obfuscate roundtrip and end-to-end smoke (standard, off, obfuscate) on empty, single-chunk, and multi-chunk content; 42/42 cargo test rclone_crypt pass on release profile. CLI parity ships with the RcloneFilenameEncryption::Obfuscate variant.
- ImageKit (23rd protocol): native REST API integration as a first-class StorageProvider. Auth via private key (HTTP Basic), endpoint api.imagekit.io. Full trait surface (list, upload, download, delete, mkdir, rename, move, search), plus media-CDN passthrough for transformations and folder operations. 20 GB media + 20 GB bandwidth/month free tier. Visible in IntroHub Discover under Photo & Media, exposed in CrossProfile, IconPicker (Media category) and SessionTabs.
- Uploadcare (24th protocol): native REST + Upload API integration. Auth via public + secret key, endpoints api.uploadcare.com (REST) and upload.uploadcare.com (multipart). Cursor-based listing, store-once semantics mapped to AeroFTP's directory model. EU-based, GDPR-friendly. Same surfaces wired as ImageKit.
- Custom titlebar 3-cluster layout (T-TOPBAR-3-CLUSTER, carry-over from #133, recap in #161): the right side of the unified VS Code-style titlebar is now grouped into three explicit clusters. Cluster 1 (page nav) holds Connect / Disconnect with a fixed minimum width, eliminating the click-shift drift reported in #129 (clicking Disconnect, then the new Connect button, shifted icons enough that a fast aimed click could land on Lock or Settings). Cluster 2 (utility) holds Cyber Toolkit (cyber theme only), AeroVault, Lock and Settings without internal separators. Cluster 3 (window) holds Minimize, Maximize, Close. No new props, no new i18n keys, no behaviour changes outside the layout fix.
- About > Technical: library version check: a new "Check Updates" button in the Linked Libraries section queries crates.io for each of the 12 tracked libraries (russh, russh-sftp, suppaftp, reqwest, keyring, aerovault, aes-gcm, argon2, zip, sevenz-rust, quick-xml, oauth2). Each row shows current version, an inline upgrade arrow when a newer release exists, and a colour-coded status badge (green check, yellow up-arrow, red triangle for major bumps). Reus

[3.7.1] - 2026-05-04
Mount Manager + community wishlist push (issue #147)
A community-driven release closing the v3.7.x medium-effort cluster from issue #147 and shipping the first big-feature ask from the same thread, the persistent Mount Manager. Filen Desktop's local WebDAV and S3 bridges now connect on the first try, AeroFile gains an aggregate multi-file Properties view and a recursive * flatten search, AeroSync wrapper scripts round-trip as .sh / .ps1, and a long list of polish items lands in one batch (PathBar empty-area edit, Settings keyboard model, smart Open with default app, configurable provider icon size, drag-reorder custom icons, dedup-aware Server Health dots on Discover, S3Drive icon + setup banner). My Servers gains a unified table layout with drag-to-reorder columns and a per-protocol dedup footer.
Added
- Mount Manager: new persistent mount registry reachable from File > Mount Manager, the My Servers toolbar, and the connected remote address bar. Saves multiple mount configs (profile, remote path, mountpoint, read-only, cache TTL, allow-other, auto-start) in either a plaintext sidecar JSON (default, daemon-friendly) or in the encrypted vault, toggleable from the dialog header. Per-row Mount / Unmount / Open in file manager / Edit / Delete actions, with a "Pick free drive letter" helper on Windows. Phase B autostart installs systemd-user units on Linux and Task Scheduler ONLOGON entries on Windows. Phase C "Open mount in file manager" auto-creates a default mount for the connected profile when none exists, waits 800ms for FUSE / WebDAV to settle, then opens the OS file manager. Tracked mounts inherit the GUI's vault credentials through aeroftp-cli --profile; mount configs themselves never carry secrets.
- Filen Desktop local presets: two new Discover entries connect AeroFTP to a logged-in Filen Desktop instance over the local Network Drive bridges. Filen Desktop (local WebDAV) runs at local.webdav.filen.io:1900 over HTTP with basic auth (username and password set in Filen Desktop > Network Drive > WebDAV, separate from the Filen account). Filen Desktop (local S3) runs at local.s3.filen.io:1700 with literal filen region and bucket and path-style addressing. Both presets ship inline setup steps that surface the Filen Desktop configuration path the user has to walk before the bridge accepts connections.
- Multi-file Properties: right-clicking on two or more files in AeroFile (local panel and any of the 22 remote providers) now opens a dedicated aggregate Properties dialog, mirroring the Windows multi-select view. Reports total file count and folder count, summed bytes with formatted units, common parent path, modified-date range (single Modified row when all entries share the same mtime, otherwise Oldest / Newest pair), and a "Mixed" indicator on the permissions row when entries do not agree. Tri-state Read-only and Hidden rows surface from a parallel get_file_properties lazy load. A scrollable list of selected entries with kind icon, name, and per-item size sits at the bottom.
- Recursive search in AeroFile: typing * or ** in the local search box now flattens the subtree under the current directory, every descendant file and folder is listed with its relative path, BFS-bounded at 32 levels and 5,000 entries (clamped to 20,000). Optional residual filter after the marker (* foo, ** foo) narrows the result by substring on the relative path. Search bar flips purple while flatten mode is active and warns when the entry cap is reached.
- Custom Icons Manager: Settings > Appearance > Icons hosts a standalone gallery for the global custom-icon library, with upload of SVG / PNG / JPG / WEBP / ICO, sort by recent or A-Z, drag-reorder (in recent mode), inline rename via double-click, and delete with confirmation. Shares storage with the per-profile Choose Icon dialog so changes round-trip both ways through a aeroftp-custom-icons-changed window event.
- AeroSync wrapper script export: the AeroSync Templates dialog now ex

[3.7.0] - 2026-05-01
AeroRsync session batch + Crypto overlay + Server Health Check + CLI/MCP parity
Big-batch release closing the P3-T01 wave (AeroRsync streaming + batch transport) and shipping three parallel workstreams: a new crypto overlay layer (rclone-crypt + AeroVault session model), a real-time Server Health Check engine wired into IntroHub Pro, and the CLI/MCP parity wrap-up. The standalone aerovault crate is bumped to 0.3.4 with the new overlay-session API.
Added
- AeroRsync session-cached batch transport — new AerorsyncBatch trait (W3.1) + russh implementation with channel + raw stream + key auth (W3.2) + generic do_upload / do_download helpers (W3.2 b2). A single SSH session now amortizes many consecutive delta transfers.
- AeroRsync batch surface end-to-end — open_delta_batch + try_delta_transfer_with_batch wired into sync_tree_core (W4.1 + W4.2). SyncReport exposes delta_files and bytes_on_wire; SyncPanel surfaces the new batch counters.
- Rclone-crypt provider session — rclone-style crypto overlay with deterministic filename obfuscation, streaming chunk-based encrypt/decrypt, rclone_crypt_provider_* Tauri commands and a RcloneCryptUnlock dialog for interactive unlock.
- AeroVault overlay session model — open/list/upload/download routed transparently through an active encrypted overlay, status badge in App.tsx, aerovault_overlay_* commands wired in lib.rs, spec updated in docs/AEROVAULT-V2-SPEC.md. The aerovault crate is bumped to 0.3.4 with the overlay API + KEK derivation polish.
- Server Health Check engine — health_check.rs runs real DNS / TCP / TLS / HTTP probes with latency measurements, 0-100 health scoring, and a per-protocol capability matrix. useProviderHealth hook does parallel batch refresh with auto-cleanup, HealthRadial SVG gauge is wired to the live results, MyServersPanel + ServerCard show contextual badges and a right-click context menu.
- CLI/MCP parity wrap-up — aeroftp-cli and mcp/tools.rs align argument shapes and output schemas with wave-5 (cross-profile transfer) and wave-6 (Gap 4 caps + 6 ops tools) so an LLM can use either surface interchangeably.
- MCP wave-5 — cross-profile transfer tools (tool count 25 → 27): aeroftp_transfer / aeroftp_transfer_tree (and remote_transfer / remote_transfer_tree aliases). Single-file or recursive copy between two saved profiles, source and destination provider opened once and reused across the whole batch. Path validation rejects .., null bytes, leading -, empty paths and >4096 chars on both sides; identical src/dst profiles refused by id and canonical name; audit log includes profile ids, paths, bytes, duration. Progress streaming throttled at every ~5 files or 2% delta.
- MCP wave-6 — Gap 4 caps + 6 ops tools (tool count 27 → 39): aeroftp_check_tree gains per-group caps (max_match, max_differ, max_missing_local, max_missing_remote, all falling back to max_entries_reported) plus omit_match to drop the noise bucket entirely from groups while keeping the counter in summary. Six new ops tools wrapping CLI semantics: aeroftp_touch (create empty file or report exists), aeroftp_cleanup (BFS for orphan .aerotmp, dry-run by default, caps 100k entries / depth 100), aeroftp_speed (random-payload upload+download+SHA-256 throughput probe, 4 MiB default / 64 MiB max, 1..3 iterations), aeroftp_sync_doctor (preflight risk summary with suggested_next_command), aeroftp_dedupe (SHA-256 dup detection grouped per size, modes newest/oldest/largest/smallest/list, dry-run by default), aeroftp_reconcile (categorized size-only diff variant of check_tree with elapsed_secs and suggested_next_command). Each new tool ships with a remote_* alias.
Changed
- MEGA Native crypto polish — non-regressive cleanup on top of the v3.6.10 canonical-layout fix (less log noise, nonce/key edge cases, listing pagination).
- B2 native v4 hardening — auth/list/upload/download retry surface aligned with provider-trait expectations; coverage extended in integration_b2.rs.
- aerovault 0.3 → 0.3.4 — new

[3.6.10] - 2026-04-28
MEGA Native canonical crypto, 2FA modal hookup, TOTP QR, mouse Back button
Same-day rollup on top of v3.6.8. The originally-tagged v3.6.9 build was deleted before a Linux release was published because the GitHub Actions Snap step was dying silently during LXD setup on three consecutive reruns; the work that was already in v3.6.9 (2FA modal hookup, TOTP QR, mouse Back button) is rolled into this v3.6.10 cut together with a critical MEGA Native crypto interop fix that landed in parallel. The Snap workflow step is marked continue-on-error: true so the rest of the Linux release pipeline (deb / rpm / AppImage signing and upload) is no longer blocked when the Snap action-build crashes; Snap Store stays on v3.6.8 until we either pin a newer action ref or move the Snap build to its own job (tracked for v3.7.0).
Fixed
- MEGAcmd login on Linux/macOS (critical) — saved-profile connect against the MEGAcmd backend was failing every time on Unix with Extra args required in non-interactive mode. Usage: login [...] email password | exportedfolderurl#key | session. The Unix path was passing only the email as a CLI arg and piping the password to stdin, on the assumption (carried forward from AUTH-01 audit notes) that this kept it out of ps listings. In reality mega-login is a non-interactive one-shot wrapper that talks to the background mega-cmd-server and does not read stdin at all in that mode; the stdin trick only worked inside the interactive mega-cmd shell, which AeroFTP never invokes. Fixed by passing email + password as CLI args on every platform, matching what rclone, the official MEGA Sync, and every other MEGAcmd integration already does. The brief ps exposure window during login (~1s) is the same surface area that env var or password-file alternatives would have, so there is no real security regression. Reproduced by @aleimob on a fresh Ubuntu install with a saved MEGA-CMD profile against dev@aeroftp.app.
- MEGA Native upload interoperability with MEGA Web (critical) — file node keys uploaded by AeroFTP through the MEGA Native API were stored in a non-canonical layout (raw 16-byte file key followed by nonce + meta-MAC), so AeroFTP could decrypt its own uploads but MEGA Web, MEGA Mobile, and any other official MEGA client derived the AES key from the canonical obfuscated layout and decrypted the payload with the wrong key, producing what looked like ciphertext-on-display. The fix in mega_crypto.rs::pack_node_key() now stores the MEGA-compatible obfuscated 32-byte node key, unpack_node_key_with_mac() derives the AES key by XOR-ing the first 16 bytes against the nonce / meta-MAC half, compute_attr_key() uses the canonical key for file attributes, and meta_mac() condenses the chunk MAC with the required [mac[0..4] ^ mac[4..8], mac[8..12] ^ mac[12..16]] XOR pairs. A unpack_node_key_legacy() fallback is kept so AeroFTP can still read files uploaded by the buggy older builds; download paths verify the canonical MAC first, then fall back to the legacy layout if needed. Existing legacy uploads must be re-uploaded if they need to open in MEGA Web (MEGA Web cannot use the legacy fallback). Independently verified end-to-end with megajs decoding the file name and plaintext from a fresh share link, and visually verified by the user in MEGA Web.
- 2FA prompt modal did not open from saved-card click (issue #128 follow-up) — saved-card connect goes through onSavedServerConnect and tab reconnect goes through switchSession. Neither path called tryShowTwoFactorPrompt, so the modal advertised in v3.6.8 never appeared when users clicked a saved MEGA / Filen / Internxt card whose persisted session had expired. The dispatcher is now wired into all three catch handlers; pattern matching against the backend's E_MFAREQUIRED / ENOTOKEN messages is shared so the matching surface is identical across paths. Test reproduction confirmed by the original reporter (@EhudKirsh).
Added
- Mouse Back button (button code 3) closes the topmost modal — t

[3.6.8] - 2026-04-28
Community wishlist quick wins + MEGA 2FA + Filen TOTP persistence
A focused patch release built around the v3.6.8 wishlist thread (issue #133) plus two long-standing items from issue #128 (MEGA 2FA TOTP and the Filen TOTP-persisted-after-save bug). Twelve community-reported items land together so the rest of the thread can be triaged on a fresh baseline. No MCP surface changes; the VS Code extension does not need a bump.
Fixed
- Yandex Disk preset "Docs" link 404 — the registry entry for yandexdisk-webdav pointed at yandex.com/support/disk-desktop-windows/start/webdav-client.html, which no longer exists. Repointed to yandex.com/support/disk/ (verified 200 OK). (reported by @EhudKirsh)
- WebDAV Edit form helper links — the provider footer with Create Account / Docs / Generate password buttons was hidden in Edit mode via a editingProfileId guard, so users editing a Yandex / OpenDrive / Koofr profile could not jump back to the docs or password generator. The guard is gone; the footer renders the same on first connect and on Edit. (reported by @EhudKirsh)
- WebDAV Edit form Server Endpoint URL editable in Edit — the Server Endpoint URL and Port fields were locked on first connect for pre-configured providers but became editable on Edit, which was easy to break by accident. Both fields are now readOnly when selectedProvider.defaults?.server is set, with a muted visual state. (reported by @EhudKirsh)
- OneDrive logo misshapen at small sizes — the previous SVG layered three paths on a 24x24 box, producing an outline that did not look like the canonical Microsoft cloud icon, especially in the Discover Services grid. Redrawn with the standard 4-cloud composition on a 32x24 viewBox, four fill stops. (reported by @EhudKirsh)
- Speed Test modal "Run comparison" button cropped at large font sizes — the modal used pt-[5vh] + max-h-[90vh], leaving the footer below the fold for users on 19 / 22 px font sizes. Vertical budget expanded to pt-[2vh] pb-[2vh] + max-h-[96vh]. (reported by @EhudKirsh)
- Activity Log badge counter ignored the active filter — the bottom-bar Log badge counted every emitted event, so it crept up to 99+ even when the panel was filtered to Errors only. The panel now persists filterType and showCloudSync in localStorage and broadcasts CustomEvents on every change; App.tsx subscribes and recomputes the badge using the same filter predicates as the panel. (reported by @EhudKirsh)
- Provider icons in the Choose Icon dialog silently failed to select — Hetzner, MinIO, Koofr, FileLu, Blomp, OpenDrive, FeliCloud, Pixelunion, Aspnix, DriveHQ, Quotaless, Jianguoyun, Yandex Disk, Immich and other PNG-backed provider logos render as <img>, but reactLogoToSvgDataUrl() searched for an <svg> and returned null, so the click was a no-op. Added an <img> fallback that returns the image src as the data URL — works unchanged with the existing customIconUrl consumer. (reported by @EhudKirsh)
- Custom icons "No custom icons yet" placeholder shown next to an existing icon — the empty-state copy contradicted the Current / On-server section above when a user had already picked an icon. The placeholder is now suppressed when either is non-empty. (reported by @EhudKirsh)
- Filen TOTP code persisted across reconnects (issue #128) — the 6-digit 2FA Code field was saved into the profile's options.two_factor_code on connect, so a reconnect a few minutes later replayed yesterday's code and the API rejected it with "Wrong Two Factor Authentication code". TOTPs are single-use and rotate every 30 seconds; the saved-profile path now strips two_factor_code from optionsToSave on both Edit and New Server flows, the same way Filen / Internxt / MEGA web clients ask for the code on every login. (reported by @EhudKirsh)
Added
- Hide username on My Servers cards — new toggle in the toolbar (AtSign icon, persists across sessions as aeroftp_hide_server_username). When active, the user@host subtitle becomes host-only across grid and list views, fre

[3.6.7] - 2026-04-27
Share-link reliability and UX paper cuts
A focused patch release. The headline is a silent regression on MEGA Native share-link generation that surfaced during an interoperability test session against MEGA's own infrastructure: the URL we built used the internal node handle instead of the public handle returned by the API, so links opened on mega.nz with "File cannot be accessed". Same encryption key, wrong path component, no error from our side. The fix lands together with a CLI verification flag and a few small UX wins voted up on the v3.6.7 wishlist.
Fixed
- MEGA Native share link — aeroftp-cli link --profile <mega-native> was building mega.nz/file/<internal-node-handle>#<key> instead of mega.nz/file/<public-handle>#<key>. The encryption key portion was always correct, only the 8-character handle in the path was wrong, so generated links opened on a "File cannot be accessed" page on mega.nz. Fix: capture the public handle returned by the MEGA API l (export) command and use that in the URL. mega_native.rs::create_share_link.
- S3 explicit endpoint precedence — when a saved server profile has both a configured S3 endpoint and a host populated by the GUI, the explicit endpoint now wins. Also detects bucket-addressing errors and reports them as ProviderError::Configuration so they are actionable on the CLI side. (commit 27d2ccc8, originally merged via #132 into the local tree, formally rolled into this release.)
- Edit Server form, S3 Path-Style toggle — the Path-Style URLs checkbox was wired into QuickConnect via ProtocolSelector but never plumbed into Settings > Servers > Edit Server, so users could not flip the toggle on a saved profile after creation. Now exposed in the S3 section of Edit Server, sharing the existing protocol.pathStyle i18n key. Surfaced by @voland-key on #132.
- Edit Server form, Public URL Base scope — the "Public URL Base" field was rendered in Edit Server for every protocol including S3 / Azure / MEGA / Filen / GitHub / OAuth providers, with a caption that explicitly reads "Enter the HTTP URL that maps to your FTP root folder". The field is only meaningful for filesystem-mounted protocols whose tree maps to a plain HTTP service. Now gated to FTP / SFTP / WebDAV; other providers build their share links via native APIs and do not consume this field.
Changed (FTP layer — suppaftp 8.0.1 to 8.0.3)
- suppaftp upgraded from 8.0.1 to 8.0.3 after a fresh upstream review (analysis archived in docs/dev/reports/2026-04-27-suppaftp-upgrade-analysis.md). The pin held since 8.0.2 introduced an ungated std::os::fd::AsFd call that broke Windows builds. Upstream still ships that code in 8.0.3, but it is feature-gated behind tokio-async-native-tls, which AeroFTP does not enable (we use tokio-rustls-aws-lc-rs). Verified by reading tokio_ftp/tls/native_tls.rs in the upstream 8.0.3 source. The legacy FTP_CLIENT crate stays pinned at 8.0.1 because it uses the broken feature.
- The upgrade brings 14 upstream fixes that affect AeroFTP's hot path: undefined behavior in the tokio TLS tcp_stream() borrow chain (PR 135); replaced unwrap() panics on server-controlled EPSV / SIZE / MDTM responses with proper error handling (PR 146); infinite loop in async feat() on mid-response disconnect (PR 137) and the same fix for read_response_in() on multiline + disconnect (PR 138); data_connection_open flag now set only after successful open, removing a class of false DataConnectionAlreadyOpen errors (PR 136); MLSX parser accepts cdir / pdir per RFC 3659 (PR 139) and 4-digit unix.mode like 0755 (PR 140); DOS LIST parser handles sizes with commas like 1,234,567 (PR 142); parse_lstime adjusts year for future dates the way GNU ls does (PR 143); DOS time parser handles a space before AM/PM (PR 144); abort() no longer appends when the server sends a direct 226 (PR 141); active mode uses EPRT for IPv6 (PR 145); cwd() accepts 200 Command OK in addition to 250 for non-RFC-959 servers (PR 153). All cargo check / cargo clippy --all-

[3.6.6] - 2026-04-27
Agent surface, onboarding polish, server speedtest, community wishlist
The full v3.6.6 cycle ran in roughly 36 hours and is shaped by two parallel community feedback waves. Issue #125 (@EhudKirsh) — a clean reproduction of CLI/Terminal bugs — prompted a 4-Sonnet black-box audit of the AI-agent surface that surfaced 13 friction points; the same thread invited Ehud to point an AI assistant at agent-info --json and agent-bootstrap --json, and the audit closes that loop. Issue #130 (@scottonanski) reframed the first-run empty state, and most of the onboarding polish ships in response. Issue #129 stayed open as the v3.6.6 wishlist thread, and many of the small UX wins below answer specific items voted up there.
Added
- aeroftp-cli agent-connect <profile> + MCP tool aeroftp_agent_connect — single-shot connect surface for AI agents. Returns one JSON payload with per-block status (connect, capabilities, quota, path), replacing the boilerplate sequence connect → about → df → ls /. Block status values are ok / unsupported / unavailable / error; agents read connect.status for the go/no-go decision and degrade gracefully on the rest. Live-connect allowlist (FTP / FTPS / SFTP / WebDAV / S3 / GitHub / GitLab) is documented inline in --help. For protocols outside the allowlist (pCloud, Filen, Dropbox, etc.) the response still includes valid capabilities, path and profile blocks; only the connect block reports status: "unsupported" and the CLI exits 0 because the rest of the payload is still actionable. New lib module agent_session.rs is the single source of truth, also translating profile.options camelCase keys (bucket, region, tlsMode, privateKeyPath, …) into ProviderConfig.extra snake_case so S3 / Azure / SFTP-key / FTPS profiles connect via vault for the first time on the agent path.
- agent-info --json exposes a protocol_features map keyed by protocol → list of feature tokens (share_links, resume, server_copy, versions, thumbnails, change_tracking, etc.) plus an agent_connect_supported_protocols array. Collapses what used to require N agent-connect calls (one per profile) into a single batch query — driven by the audit's Battery D where one agent had to walk 69 profiles to discover share-link capability.
- head -c / --bytes <N> byte-range preview for remote files. Works on binary content (returns base64 in JSON when bytes aren't valid UTF-8) and reports bytes_returned / total_size / truncated / encoding. Closes the audit's Battery A "no way to get the first 4KB without a full download" gap.
- ls --limit N, --files-only, --dirs-only flags. Summary now carries truncated: bool and total_before_limit: int so agents can detect partial results unambiguously. Same trio added to find, plus a --name <glob> alias for the positional pattern (the natural first-attempt form for agents who expect named args).
- Cross-profile multi-select on My Servers — click a server card body to toggle Cross-Profile selection (icon button still triggers Connect). Up to two cards selected; third click drops the oldest FIFO. Indigo ring + arrow-up-right badge for source, emerald + arrow-down-left for destination. Always-visible Cross-Profile button in the toolbar with three brightness states (0 / 1 / 2 selected) and a counter badge. Right-click context menu offers Set as source / destination for direct assignment. Drag-to-reorder now works while a filter chip is active or a search query is typed.
- Server SpeedTest — new isolated benchmark dialog and CLI parity. GUI: Single / Compare tabs, multi-select up to 8 servers, parallel selector, ranked compare table with tri-state integrity, history summary card with regression warning (last < median × 0.7), Esc cancels running test. CLI: speed subcommand upgraded with random non-compressible payload (was zeros), SHA-256 integrity, TTFB measurement, --no-integrity flag, --json-out. New speed-compare subcommand emits JSON v1, CSV, and Markdown reports. redact_url_for_display() is applied to every report an

[3.6.5] - 2026-04-26
CLI polish + cross-provider correctness sweep
Drop-in patch driven by an end-to-end stress test of aeroftp-cli 3.6.4 against real provider accounts (S3, Backblaze, Storj, FTPS, Dropbox, Google Drive, OneDrive, Box, Koofr, Zoho WorkDrive, kDrive, Drime). The session surfaced four recurring correctness defects that span 8 providers, plus a dozen ergonomics rough edges that became visible only when the CLI is driven by an external AI agent rather than a human typing one command at a time. Fixes are surface-level and contained to the CLI binary plus per-provider trait impls; no architectural change.
Fixed
- FTP CLI now respects the server-provided home directory - aeroftp-cli was issuing a hard CWD / after login, which overrode the home directory negotiated by the FTP server (typically /home/user on non-chroot installations like default vsftpd) and landed the session at the filesystem root, which is usually non-writable. This surfaced in a head-to-head benchmark vs rclone where the same put rel/path/file.txt worked under rclone but produced 550 Permission denied here. Three coordinated fixes: the FTP provider skips the post-login CWD when initial_path is bare / (aligning with rclone, lftp, FileZilla, ftp(1) and curl which all defer to PWD post-login); the CLI path resolver now returns empty for empty user input so the provider's canonical default kicks in instead of an artificial absolute root; and mkdir -p preserves relative-vs-absolute semantics instead of always prefixing /, so mkdir -p rel/path issues MKD rel/MKD rel/path (which the server can satisfy under the user's home) instead of MKD /rel/path (which non-chroot servers reject for the same write-permission reason). Absolute paths like /etc continue to target the filesystem root verbatim. Validated end-to-end against vsftpd in a Docker harness, no regression on the existing chroot case.
- OAuth saved servers can now be renamed from the Edit dialog (issue #127) - In My Servers, hovering over an OAuth tile (Google Drive, Dropbox, OneDrive, Box, pCloud, Zoho WorkDrive, Yandex Disk, 4shared) and clicking the Edit pen now opens a form whose display name is editable, matching the behaviour of WebDAV / E2E / API providers. Two root causes: the OAuthConnect "Active" branch (rendered when tokens already exist for the provider) skipped the Save toggle and the Connection Name input entirely, so there was no field to type into. And the OAuth save callback in ConnectionScreen searched for the existing profile by name === saveName, so the moment the user changed the name the lookup failed and a brand-new profile was created next to the original instead of renaming it. Fix: render the Save toggle + name input in the Active branch (gated on the same wantToSave flag the inactive branch uses), and prefer the explicit editingProfileId over the name-match heuristic when persisting an OAuth edit. OAuth-specific fields (clientId, clientSecret, scope, region) stay locked - renaming a saved server is purely a local label change.
- find glob matched as substring across 7 providers — aeroftp-cli find /path "*.txt" was returning report.TXT.rtf and any file whose name contained the literal txt, because the per-provider find() implementations forwarded the pattern straight to the upstream search API (which is substring-by-name on most clouds) without re-applying glob semantics on the response. Affected: Dropbox, OneDrive, Box, Koofr, Zoho WorkDrive, Drime, kDrive. Fix: server-side query is now broad-prefiltered (glob characters stripped, only the literal portion sent), then the response is re-filtered client-side via the shared matches_find_pattern helper that powers the rest of the CLI. Google Drive (already filtered against its own catalog) gets the same belt-and-braces second pass.
- mkdir + put failing on empty-prefix object stores — aeroftp-cli put file.bin s3://bucket/key returned exit=2 "Parent does not exist" on a fresh bucket because the put plumbing was issuing a separate

[3.6.4] - 2026-04-25
Patch release: Windows keystore export fix + autostart UX + update opt-out
Small but high-impact patch release driven by two community bug reports (issues #123 and #124). The headline fix unblocks the Settings → Backup → Export Keystore flow on Windows, where every export was leaving an orphan .tmp file behind and surfacing an "Access is denied (os error 5)" error. Three quality-of-life settings round out the release.
Fixed
- Windows keystore export os error 5 (issue #124) — Exporting a vault backup from Settings → Backup raised "IO error: Access is denied. (os error 5)" on every Windows machine and left an aeroftp_keystore_*.tmp file in place of the final .aeroftp-keystore. Root cause: the atomic write helper opened the freshly-written temp file with File::open (read-only on Windows) and then called sync_all, which on Windows maps to FlushFileBuffers and requires a GENERIC_WRITE handle. The flush failed before the rename ran. Fix: keep the existing write handle through flush + sync_all and gate the parent-directory fsync to Unix only, since File::open on a directory needs FILE_FLAG_BACKUP_SEMANTICS on Windows and is a no-op for durability there anyway.
- Windows internal Terminal frozen on Start (issue #125) — Opening AeroTools → Terminal → Start on Windows produced a blinking cursor with no shell prompt and no response to keystrokes; the only escape was restarting the app. Root cause: the launcher passed -Command "function prompt { ... }" to PowerShell to inject a colored prompt, but on Windows 10 with the default ExecutionPolicy the parser stalled inside -Command, spawn_command never returned, the Tauri invoke awaited forever, the frontend never received a session id, and every keystroke was silently dropped at the connected-tab gate. Fix: drop the prompt customization on Windows and start PowerShell as a plain -NoLogo interactive shell. Linux and macOS were unaffected. A user-level colored prompt can be added via $PROFILE if desired.
- NSIS installer now reports the PATH change in the install log (issue #125 follow-up) — After registering $INSTDIR in HKCU\Environment\Path, the installer now prints "Open a NEW terminal to run 'aeroftp-cli'" so users who installed via WinGet/UniGetUI in an already-open PowerShell are not surprised when aeroftp-cli is "not recognized" — existing shells cache %PATH% at launch and need to be reopened.
Added
- Password strength meter on the keystore backup form — The Export Keystore section now shows the same animated 4-segment strength bar already used by AeroVault, with a 0–100 score and a colour-coded label (Weak/Fair/Strong/Excellent). Reuses PasswordStrengthBar so future tweaks land in both places at once.
- Start minimized to tray on autostart (issue #123) — New "Start minimized to tray" checkbox under Settings → General → Startup (visible only when "Launch on system startup" is enabled). When the OS launches AeroFTP from the autostart entry, the main window stays hidden and only the tray icon appears, matching the behaviour expected from background sync apps. Manual launches (double-click on the desktop or Start menu shortcut) always show the window. Detection uses a new --autostart argument passed by tauri-plugin-autostart and surfaced to the frontend via is_autostart_launch. Default off — existing users see no change.
- Don't check for updates toggle (issue #123) — New checkbox under Settings → General → Software Updates that disables both the 5-second startup check and the periodic 24-hour check. The manual "Check for Updates" button continues to work, so the option simply gives users who manage AeroFTP through external package managers (WinGet, AUR, Snap auto-refresh) a way to opt out of the in-app update prompts and bandwidth.
Changed
- NSIS installer no longer reinstates the desktop shortcut on every upgrade (issue #123) — On a fresh install the bundler still creates Desktop\AeroFTP.lnk as before. On an upgrade, however, the installer now snapshots the desktop s

[3.6.3] - 2026-04-25
Unified Tool Dispatcher + Cloud Provider Sweep + AeroVault Pro Foundations
The post-3.6.2 sprint consolidates three years of organically-grown AeroAgent surface into a single, audited tool engine shared by the Tauri GUI, the standalone aeroftp-cli binary and the MCP server. In parallel, eighteen cloud providers gain trash management, version history, share links and label/tag CRUD, while the desktop backend grows new pillars (server health diagnostics, TOTP 2FA scaffold, vault history) that prepare the ground for AeroVault Pro and the upcoming biometric unlock work.
Added
- Unified AI tool dispatcher (T3 Gate 2) — All AeroAgent tools (53 entries across local, system, remote and RAG/memory areas) now flow through a single ai_core::tools::dispatch_tool with surface-aware filtering (GUI / CLI / MCP). Per-area handler modules (local_tools.rs, system_tools.rs, remote_tools.rs, agent_tools.rs) host the canonical implementations; per-surface ToolCtx impls (TauriToolCtx, CliToolCtx, McpToolCtx) bridge to the appropriate runtime. The legacy execute_ai_tool / execute_cli_tool / mcp::execute_tool dispatchers stay as thin fast-path wrappers, eliminating the long-standing drift between three parallel match statements. 11 parity tests prove identical output across surfaces; the security regression suite gains an Area B check ensuring system_tools always delegates shell_execute to the canonical denylist source. Behavioural wins: local_trash is now available on CLI, clipboard_* and archive_compress/archive_decompress use native Rust libraries instead of subprocess shellouts (no more xclip/zip/tar/7z runtime dependencies on CLI), and validate_path adopts component-aware matching so /bootcamp is no longer falsely flagged as /boot.
- Provider trait expansion — 7 new optional methods: list_trash, restore_from_trash, permanent_delete, list_versions, download_version, restore_version, create_share_link, get_storage_quota. The RemoteEntry struct grows MIME type, owner/group, octal permissions, symlink target, and a free-form metadata bag. Box, Google Drive, Dropbox, OneDrive, Zoho WorkDrive light up the full feature matrix.
- Box Pro feature set: trash management, file move/comment/collaboration, watermark (Enterprise), folder locks (Enterprise), inline tag chips with PRO badge.
- Google Drive starring + comments + properties: star/unstar from context menu, add comments via prompt dialog, set custom key-value properties and description; file listing now includes starred, description, properties fields.
- Dropbox tag management + Trash Manager: full tag CRUD via Dropbox Tags API (reuses generic BoxTagsDialog); dedicated modal for deleted files (restore + permanent delete).
- OneDrive Trash Manager: full recycle bin lifecycle (move to trash, list, restore, permanent delete).
- Zoho WorkDrive labels + versioning: list team labels, get/add/remove labels on files via ZohoLabelsDialog with color-coded toggle list; list versions, download specific version, restore/promote version through the StorageProvider trait.
- Server Health Check — Real-time diagnostics for saved servers: DNS / TCP / TLS / HTTP probes with latency stats, 0–100 health score, SVG radial gauge, latency bars, Canvas 2D area chart for trend. Right-click any server card → Connect / Edit / Duplicate / Health Check / Delete (useContextMenu hook). Batch health check across all saved servers in parallel with healthy/degraded/unreachable summary.
- TOTP 2FA scaffold (totp.rs) — RFC 6238 authenticator core ready for the optional vault second factor: issuer, period, digits, base32 secret import/export, code verification with drift window. Will surface in Settings > Security in a follow-up release.
- Vault history (vault_history.rs) — SQLite-backed recents tracker for AeroVault Pro: last-opened timestamp, security badges, dedupe by canonical path. Powers the new VaultHome recents grid and "reopen" one-click flow.
- AeroAgent server context tools registered in unified registry:

[3.6.1] - 2026-04-23
Windows First-Class Delta Sync + PR-T08 Eligibility Gate + Dependency Security
The "historical step" release: byte-level delta sync becomes a first-class citizen on Windows, with no bundled rsync.exe, no WSL requirement, and no reliance on any external binary. Windows rides the native rsync 31/32 wire protocol re-implemented in pure Rust (clean-room, GPL-3.0-or-later) that previously lived behind an opt-in cargo feature; from this release the feature is default-on and the protocol module is part of the mainline tree.
Added
- Windows cross-OS delta sync: SftpProvider::delta_transport() dispatches cross-platform. When the proto_native_rsync feature is compiled in (default from this release) and a session has SFTP + SSH key auth, Windows uses the native Rust rsync implementation end-to-end; the binary-rsync classic fallback stays available on Unix through the same DeltaTransport trait surface. No binary shipping, no WSL dependency.
- Delta Sync eligibility gate (PR-T08): before starting an AeroSync run, a cached Tauri probe (sftp_probe_delta_eligibility, 5 s timeout) verifies that the current session can actually exercise the delta path. When it can't, a modal surfaces the sanitized reason, a "Don't show again for this server" persistent preference on the saved profile, and a "Learn more" link to the public docs page. The modal fires only when the delta toggle is on and the server is SFTP — classic-only sessions are never interrupted.
- Fallback reason surfacing (PR-T05): FileOutcome and TransferEvent carry an optional fallback_reason populated only when the delta path was attempted for the file and fell through transparently. SyncPanel renders a grey classic badge (with the sanitized reason as tooltip) next to affected files — distinguishing "classic by design" from "classic after delta attempt". 7 new i18n keys translated in all 47 supported languages.
- CI Windows native build lane: new windows-native job in delta-sync-integration.yml — cargo check with and without feature, unit tests with and without feature on windows-latest. Catches cross-OS regressions at PR time.
Fixed
- SFTP upload mtime preservation: SftpProvider::upload() now sets remote atime+mtime to the local source's mtime after a successful upload, using SFTP ACMODTIME. Before this fix, every sync after an upload saw remote_mtime > local_mtime and spuriously re-uploaded unchanged files. Observed live on SSH MyCloud HD: second sync after a single-file change now reports uploaded=1 / skipped=1 where the pre-fix behavior was uploaded=2.
- Versioning archive name collision: SyncVersioning::archive_file now produces -1, -2, ... suffixed names when a second version lands with the same filename (unique_archive_path helper). Retention windows no longer silently clobber archived copies of the same file.
- CloudPanel versioning_strategy type round-trip: the field is now a tagged union that mirrors the Rust CloudVersioningStrategy shape (disabled / trash_can / simple / staggered) instead of a stringly-typed sentinel, so the select round-trips without downstream parsing.
Security
- openssl crate bumped 0.10.77 → 0.10.78: closes 5 of 6 open Dependabot alerts — CVE-2026-41676 (high), GHSA-xmgf-hq76-4vx2 (low), CVE-2026-41678 (high), GHSA-hppc-g8h3-xhp3 (high), CVE-2026-41681 (high). openssl-sys 0.9.113 → 0.9.114 bumped transitively. The sixth alert (rand 0.10.0 soundness) is not applicable — our lockfile carries rand 0.7.3 / 0.8.5 / 0.9.4.
Changed
- proto_native_rsync feature is default-on: the native rsync protocol implementation is now compiled by default. Build with --no-default-features if you want a leaner binary without native delta support (classic binary rsync stays available on Unix regardless).
- rsync_native_proto/ module moved into the tree: the native implementation, previously gitignored as a scaffold, is now versioned mainline source. Large capture harnesses (Docker images, rsync reference binaries, frozen transcripts) stay out of git via tar

[3.6.0] - 2026-04-22
AeroSync UX Upgrade + Critical SSH Host-Key Fix
Release focused on making the AeroSync optimized-transfer path visible to the user and on a critical SSH host-key dialog fix. The optimization logic has been progressively landed over the last weeks; this release is the moment it becomes visible in the product.
Added
- Delta Savings widget in AeroSync: when a file travels through the optimized transfer path during sync, an inline badge next to the file's status marks it; at the end of the run an "Optimized transfer" summary card aggregates N files · bytes saved · speedup. When the effective speedup falls below 1.5x the card switches to a neutral "Optimized transfer" variant to avoid misleading framing. The widget is fully theme-aware across light/dark/tokyo/cyber and hidden entirely when no file benefited from the path. Translated in all 47 supported languages.
- Per-file breakdown in aeroftp_sync_tree MCP tool: the response now carries summary.delta_files[] (array of {path, bytes_sent, total_size, speedup}) capped at 500 entries, plus a summary.delta_files_truncated flag when a run crosses the cap. Aggregate counters in summary.delta_savings keep counting past the cap. Both keys are omitted on runs where no file used the optimized path, preserving the absence-vs-null contract with the existing delta_savings block.
Fixed
- Critical: Host Key Changed dialog no longer reappears after Accept: the russh library reports the changed-key line number as 1-based; the internal sftp_remove_host_key command was treating it as a 0-based array index, which meant Accept surgically removed the line after the stale entry instead of the stale one itself. Repeated Accept clicks piled valid entries on top of the original stale one, and every subsequent connection hit the stale line first and re-triggered the dialog. The fix uses 1-based indexing correctly and now also prunes any other plaintext entry for the same (host, port, algorithm) tuple that matches the incoming key's algorithm — so files already corrupted by earlier broken attempts get cleaned up in the same pass. 11 new unit tests pin the regression cases (line zero rejected, 1-based indexing, duplicate pruning, host-mismatch corruption guard, hashed-entry tolerance).
Changed
- Optimized transfer path reachable from SyncPanel on SFTP: earlier releases had the decision wired in the unified sync core only — AeroSync UI actually iterates per-file commands that never entered that branch. This release extends the decision to upload_file / download_file / provider_upload_file / provider_download_file so sessions with SFTP + SSH key authentication + a capable remote now actually exercise the optimization in the day-to-day UI flow. The decision remains self-gated (silent fallback to classic when the session is not eligible); hard rejections (SSH host-key mismatch, permission denied) surface as transfer errors without silent retry.
- TransferEvent now propagates optional delta_stats: the event emitted to the frontend on complete carries per-file stats from the optimized path when applicable (serialized with skip_serializing_if, absent for classic transfers — no wire overhead for non-SFTP providers). Frontend accumulates these into the session-level summary client-side.
MCP (pre-release carryovers from v3.6.0 cycle)
- aeroftp_read_file soft-truncate dentro hard cap: oversized file (oltre preview_kb ma entro il cap 1 MB) ritornano contenuto troncato con truncated:true invece di errore duro. Il validator rifiuta solo oltre il hard cap 1 MB. Elimina i retry forzati che gli agent facevano quando incontravano file appena oltre la finestra di preview richiesta.
- aeroftp_check_tree espone compare_method anche sul gruppo match: il JSON di ritorno ora include groups.match dettagliato alla pari di differ/missing_local/missing_remote. Ogni entry porta compare_method: "checksum" | "size" così l'agent sa se il match è stato crittograficamente verificato o è fallback dimensionale (tipicamente 

[3.5.9] - 2026-04-20
CLI Agent Experience Polish
Follow-up patch to v3.5.8 focused entirely on the CLI surface. All items are small, independent, and addressed in one coherent pass so an agent using aeroftp-cli against a generic FTP hoster has the same UX quality the MCP server got in v3.5.8.
Added
- plan[] in sync --dry-run --json: every candidate operation is now listed with {op, path, local_size, remote_size, conflict_path}. Real (non-dry-run) runs omit the field via skip_serializing_if, so legacy parsers that never asked for dry-run see the exact same shape. Agents no longer have to fall back to parsing the text-verbose output to build an execution plan.
Fixed
- Missing-parent uploads now explain the failure: put runs a pre-flight stat on the remote parent directory. If the parent is missing the CLI errors out with "Parent directory '/X/Y' does not exist on the remote. Create it first with: aeroftp-cli mkdir -p '/X/Y'" — one crisp message instead of three retries of a generic 553 Can't open that file: No such file or directory returned by the hoster. is_retryable_exit now excludes exit code 2 (not-found) so the retry loop stops burning attempts on stable failures.
- Sync remote scanner auto-reconnects on transport failure: sync_core::scan_remote_tree now classifies list() errors against the same is_transport_level pattern used by the MCP pool (variant matches on NotConnected/ConnectionFailed/Timeout/NetworkError/IoError plus message patterns like "Data connection is already open", "broken pipe", "connection reset"). When it fires, the provider is disconnected and reconnected, then list() is retried once. Previously the scanner logged a warning and treated the failure as an empty directory — which let sync silently duplicate files that actually existed on the remote.
- ls follow-up hint no longer ships a literal *.ext placeholder: suggest_ls_followup now renders "*" so agents copy-pasting the hint get real results. The *.ext string survives only in bootstrap playbook JSON where it is documented as a placeholder the user must substitute.
Build
- cli-smoke Windows runner installs Strawberry Perl: the openssl-sys vendored build pulled in transitively by ssh2 = "=0.9.5" requires Params::Check to configure OpenSSL, and the stock windows-latest Perl no longer ships it. Added a choco install strawberryperl step gated by runner.os == 'Windows'. Linux and macOS jobs are unaffected.
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.5.8] - 2026-04-20
MCP Hardening + Appendix C Closure
Hardening pass on the MCP server surface (connection pool recovery, batch operations, richer scan output) plus the final closure of the CLI Appendix C roadmap.
Fixed (MCP)
- Connection pool auto-reset on transport failure: after a tool call fails with a transport-level error (stale data channel on FTP, broken pipe, NotConnected, Timeout, network errors, message patterns like "Data connection is already open", "connection reset", "eof from server"), the pool entry is now invalidated synchronously with a fire-and-forget disconnect and the operation transparently retried once on a freshly opened connection. Upload/download sites invalidate without retry — the caller decides whether to re-transfer, but the next call on the same profile starts clean. Business-level errors (NotFound, AlreadyExists, PermissionDenied, AuthenticationFailed) are intentionally kept out of the classifier so a harmless 404 never churns connections.
- aeroftp_sync_tree dry-run returns an actionable plan: the previous response only carried aggregate summary.uploaded=0 / downloaded=0 counters. The dispatch now captures every on_file_start → on_file_done pair from sync_tree_core and returns a plan[] array ({op, path, reason, bytes}) plus a planned.{uploaded, downloaded, deleted, skipped} block. Real (non-dry-run) runs are unchanged.
- aeroftp_check_tree compares server-side checksums when available: with checksum=true, the tool now requests the remote hash via provider.checksum() whenever supports_checksum() returns true, picks a preferred algorithm (SHA-256 → SHA-1 → MD5), and compares algo-for-algo against the locally computed SHA-256. Cross-algorithm mismatches safely fall back to size-only comparison. A new compare_method: "checksum" | "size" field on each DiffEntry and a top-level checksum_remote_supported flag make the decision transparent to the caller. A one-byte swap in a same-size file now correctly lands in differ instead of silently showing as match.
Added (MCP)
- aeroftp_delete_many: batch delete of up to 100 remote paths per call with a configurable inter-delete backoff (delay_ms default 200 ms, cap 2 000 ms). recursive and continue_on_error round out the surface; the response carries a per-item result (path, deleted, is_dir, error?) plus an aggregate summary (planned, processed, deleted, errors, aborted_after). Uses the same pool auto-reset wrapper as single-shot tools.
- aeroftp_list_servers filters: optional name_contains, protocol, limit (default 200, cap 1 000), offset. Response adds total_matched, offset, limit, truncated for pagination. Lets callers work against large vaults without returning the full profile set on every invocation.
- aeroftp_read_file configurable preview window: new preview_kb argument (default 5, hard cap 1 024). The preview-too-small error message now names the current window and the cap so the caller can raise it before falling back to aeroftp_download_file.
- aeroftp_upload_file auto-mkdir: new create_parents boolean. When true, the tool recursively mkdirs every missing parent of the destination (idempotent — already-exists errors are swallowed; other mkdir errors fail fast with the exact missing segment).
Closed (Appendix C — CLI rclone parity)
- FTP stale data-connection recovery on the CLI side: parse_unix_listing / parse_dos_listing path fix plus an auto-reconnect + retry wrapper. Same root cause as the MCP pool fix above, different recovery shape.
- Reconcile plan loader round-trip coverage (2 new unit tests).
- #[allow(clippy::type_complexity)] localized on the reconcile plan signature (the domain type is load-bearing, a type alias only obscured it).
Build & Dependencies
- Six Dependabot PRs rolled in from main (axum, tokio, uuid, postcss, autoprefixer, typescript — patch/minor bumps).
- rustfmt cleanup on mcp/server.rs and cross_profile_commands.rs (indentation only, no logic change).
Tests
- mcp::tools::tests: 14 unit tests (was 6) — transport-error cla

[3.5.7] - 2026-04-19
Hotfix: v3.5.6 failed to launch
Emergency patch for the startup panic introduced by v3.5.6.
Fixed
- App failed to launch on Linux and Windows: the cross-profile plan TTL sweeper added in v3.5.6 (Phase 4.2 of the resource-lifecycle audit) called tokio::spawn inside CrossProfileState::new(). That constructor runs from builder.manage(...) during the synchronous Tauri builder setup, before the async runtime is up. The spawn panicked with "there is no reactor running, must be called from the context of a Tokio 1.x runtime" and the binary exited immediately after main. The sweeper is now armed lazily by ensure_sweeper_started() on the first store_plan call — guaranteed to run inside an async Tauri command handler where the runtime is active. All other v3.5.6 improvements are preserved.
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.5.5] - 2026-04-19
MCP Agent Parity
Sprint 1 of the MCP vs CLI parity plan. The AeroFTP MCP server gains three new tools so Claude Code, Claude Desktop, Cursor, and Windsurf clients no longer need to fall back to Bash for sync-class operations, and every long-running transfer now streams real-time notifications/progress. Warm-call latency drops ~14x vs CLI cold-start thanks to pool reuse (13-14 ms via MCP vs ~194 ms via CLI on a local SFTP target).
This release also unbreaks the main branch CI by committing the seed_test_profiles helper that v3.5.4 referenced in Cargo.toml but forgot to stage.
Added (MCP parity Sprint 1, 2026-04-19)
- MCP progress notifications: aeroftp_upload_file, aeroftp_download_file and aeroftp_sync_tree now emit notifications/progress when the caller supplies a progressToken via _meta.progressToken. Throttled to ~10 Hz with a guaranteed final flush. New mcp/notifier.rs module.
- MCP aeroftp_sync_tree tool: synchronise a local tree with a remote tree. Supports direction (upload/download/both), dry_run, delete_orphans (upload/download), conflict modes (larger/newer/skip), glob excludes, max_depth.
- MCP aeroftp_check_tree tool: compare a local tree with a remote tree and report match / differ / missing_local / missing_remote groups. Supports one_way, SHA-256 checksums, glob excludes.
- MCP aeroftp_close_connection tool: explicitly close a pooled connection by server name or id. Useful to free resources or force a fresh handshake.
- MCP pool introspection: aeroftp://connections resource now returns full pool metadata per connection (profile_id, name, protocol, state, idle_secs, connected_at, requests_served) plus max_pool_size and idle_timeout_secs on the envelope.
- Shared sync_core module (src-tauri/src/sync_core/): new scan_local_tree, scan_remote_tree, compare_trees, and sync_tree_core helpers. cmd_check and cmd_reconcile in the CLI now delegate to this core, so the CLI and MCP front-ends share a single scan/compare implementation (15 unit tests in scan.rs + compare.rs + sync.rs).
- CLI benchmark vs MCP: on warm calls MCP pool reuse delivers a measured ~14x speedup over CLI cold-start on Docker SFTP (ls / in 13-14 ms via MCP vs ~194 ms via CLI). See docs/dev/test-workspace/runs/2026-04-19-mcp-parity-sprint-1/REPORT.md.
Net MCP parity coverage moves from ~40% of CLI capabilities to ~70%; the killer feature (progress notifications) is now live.
Fixed
- CI main branch unbroken: commit 763b3253 ships the seed_test_profiles source file that v3.5.4 referenced in src-tauri/Cargo.toml but forgot to stage. Every Build AeroFTP / Strada C Prototype / Delta Sync Integration run on main from 2026-04-18 to 2026-04-19 failed during cargo target resolution with can't find bin 'seed_test_profiles'. The file is a local test helper that seeds six Docker-harness profiles (FTP, FTPS, SFTP ed25519/RSA, WebDAV, MinIO) into the encrypted vault for reproducible live-battery runs. All passwords are test literals; zero production credentials. Run with cargo run --bin seed_test_profiles after opening the vault.
Added (Strada C scaffolding — experimental, dormant)
- Native rsync delta transport (scaffolding only): built-in Rust implementation of rsync protocol 31 wired into the DeltaTransport trait. Compiled only when the proto_native_rsync Cargo feature is enabled (off by default in shipped builds). The runtime toggle lives at Settings > Advanced Sync > "Enable native rsync for SFTP delta sync" and renders only on Unix feature-on builds. Not yet routed by the sync executor: provider_transfer_executor still calls provider.download/upload directly; wiring delta_sync_rsync::try_delta_transfer into the executor is a follow-up sinergia. Enabling the toggle persists the opt-in but does not change transfer behaviour today.
- Native SSH host-key pinning: when the native leg becomes reachable, it pins the SHA-256 fingerprint captured by the parent SFTP handshake (SshHandler::check_server_key). Sessions without a captured fingerprint refu

[3.5.4] - 2026-04-17
MCP Hardening & Study-Driven Bug Fixes
A second independent audit (Claude Opus 4.7, 250 live tool calls across MCP and CLI on 32 provider profiles) surfaced a cluster of issues at the MCP boundary and a handful of CLI/provider edge cases. All findings have been fixed and re-validated against real endpoints.
Added
- CLI aeroftp mcp top-level subcommand: equivalent to aeroftp agent --mcp. The VS Code Marketplace extension (axpdev-lab.aeroftp-mcp v1.0.2+) registers aeroftp-cli mcp as the server command, so the extension now works out of the box after upgrading AeroFTP
- Shared profile_loader module: new src-tauri/src/profile_loader.rs centralizes profile option normalization (insert_profile_option, apply_profile_options) and S3 preset defaults (apply_s3_profile_defaults). Both the CLI and the MCP server consume this single source of truth, eliminating the drift that caused the "bucket required" MCP regression
- MCP JSON-RPC schema validation: tools/call arguments are now validated against each tool's inputSchema.required before the call is dispatched. Missing fields return -32602 Invalid params for '<tool>': missing required field '<name>' instead of the previous opaque provider-level "bucket required" / "path is required" errors
Fixed
- MCP S3 bucket not extracted from vault (P0): the connection pool's create_provider_from_vault previously read only the credential blob and ignored the profile's options field, where bucket, region, endpoint, and path_style live. S3 profiles (Storj, AWS, Cloudflare R2, Backblaze, Mega S3, Wasabi, iDrive E2, Alibaba OSS, Tencent COS, Google Cloud Storage, and FileLu S3) now work end-to-end via MCP. Azure container mapping and Mega mode default also restored
- MCP server did not initialize the credential vault (P0): a freshly-spawned aeroftp-cli mcp subprocess hit an empty VAULT_CACHE and returned "Vault not open" for every authenticated tool call. The server now calls CredentialStore::init() at startup (auto-unlock in keyring mode) and falls back to AEROFTP_MASTER_PASSWORD when a master password is configured. A descriptive vault_error is surfaced to the client otherwise
- MCP tool calls raced on the same server (P1): rapid-fire mkdir + upload_file against the same profile could run in parallel, and on slow NAS targets the upload reached the server before the mkdir returned, producing spurious "parent not found" errors. A per-profile tokio::sync::Mutex now serializes calls to the same server while keeping cross-server parallelism intact (via the server argument in tool args)
- MCP shutdown dropped in-flight responses (P2): stdin EOF immediately returned 0, cancelling every tokio::spawned tool-call task. The server now tracks dispatched tasks in a JoinSet and drains them with a 10s timeout on EOF, so pending responses are written before the process exits
- CLI tree panicked with clap TypeId mismatch (P1): the global --max-depth: Option<u32> collided with the max_depth: usize field on the Tree and Ncdu subcommands because clap derives the long form from the field name. The subcommand fields have been renamed to depth (CLI surface is still -d / --depth), resolving the panic. aeroftp tree / --depth 2 works in v3.5.4 on every provider
- Drime race on mkdir → put with cryptic error (P1): freshly created folders were not yet indexed when the subsequent put arrived, and the error message degraded to "Find file failed: {" because sanitize_api_error truncated the JSON body to a single opening brace. find_file_in_folder now retries transient 4xx/5xx responses with exponential backoff (200 ms / 500 ms / 2 s) and includes the HTTP status and folder ID in the final error message for diagnosis
- Filen passwordless share links failed with "Invalid salt" (P3): the v3 API rejects an empty salt field even when no password is set. create_share_link now generates a fresh 128-byte random salt on every call, regardless of whether the link is password-protected
- FileLu native mkdir returned JSON pars

[3.5.3] - 2026-04-16
Continuous Sync, MCP Integration & CLI Expansion
Added
- CLI sync --watch: continuous sync with native filesystem watcher (inotify/FSEvents/ReadDirectoryChangesW). Watches a local directory for changes and re-syncs automatically in a foreground loop, stopped with Ctrl+C. Six new flags: --watch (enable), --watch-mode auto|native|poll (backend selection), --watch-debounce-ms (event batching, default 1500), --watch-cooldown (min seconds between syncs, default 15), --watch-rescan (full reconciliation interval, default 300s), --watch-no-initial (skip startup sync). Anti-loop protection: events suppressed during active syncs and within cooldown window, editor temp files filtered (.swp, .tmp, ~, .aerotmp, .DS_Store). Incremental local scan on watcher triggers (skips full walkdir, merges changed paths with snapshot). Full rescan on timer for remote change detection. Text output: [HH:MM:SS] Sync #N (trigger) -- X up, Y down, Z del (Xs). JSON output: NDJSON with cycle/trigger/uploaded/downloaded/deleted/skipped/errors/elapsed_secs/timestamp per cycle. Works with all sync features (bisync, conflict resolution, --delete, --track-renames, --max-delete, --backup-dir). First CLI file transfer tool with native continuous bidirectional sync - rclone does not offer this
- CLI SyncCycleStats: cmd_sync now returns a structured stats object (uploaded/downloaded/deleted/skipped/error_count) instead of a bare exit code. Watch mode uses these stats for enriched per-cycle output. Non-watch callers unaffected (extract .exit_code)
- MCP Server dialog: new informational modal (Help > MCP Server...) with VS Code extension install command, Command Palette shortcut, manual JSON configuration, and config file paths for Claude Code, Claude Desktop, Cursor, and Windsurf
- MCP VS Code extension: published axpdev-lab.aeroftp-mcp on the VS Code Marketplace. One-click MCP server registration with multi-target support, status bar indicator, and 4-step diagnostics
- MCP documentation: new docs.aeroftp.app/mcp/overview page with setup guide, tool reference, rate limits, security model, and troubleshooting
- CLI --files-from: transfer only files listed in an external file (one path per line, # comments). Works with get -r, put -r, and sync. --files-from-raw variant preserves whitespace and empty lines
- CLI --immutable: never overwrite existing files on destination. Applies to get -r (skip if local exists) and sync (skip uploads/downloads that would overwrite)
- CLI --no-check-dest: skip remote directory listing during sync, assuming destination is empty. Accelerates initial uploads to known-empty targets
- CLI --max-depth: global flag to limit recursion depth on get -r, put -r, sync, and find (default: 100)
- CLI bisync --conflict-mode rename: new conflict resolution mode that keeps both versions during bidirectional sync. The remote version stays as-is, the local version is uploaded with a .conflict-{timestamp} suffix. Also adds newest/oldest as aliases for newer/older, and largest/smallest as aliases for larger/smaller
- CLI dedupe 7 new modes: newest (keep most recent), oldest (keep oldest), largest (keep biggest), smallest (keep smallest), rename (rename duplicates with numeric suffix), interactive (prompt per group, TTY-only with skip fallback), list (list duplicates without action). All modes display mtime alongside size in output
- CLI --suffix-keep-extension: when using --backup-dir with --suffix, places the suffix before the file extension (file.bak.txt instead of file.txt.bak)
- CLI --default-time: configurable fallback mtime when backend returns None. Accepts ISO 8601 or now. Applied in sync comparisons to avoid false-positive mismatches
- CLI --inplace: skip .aerotmp temp file pattern and write downloads directly to the final path. Faster on network filesystems but interrupted downloads produce corrupt files
- CLI cleanup command: scan remote directory for orphaned .aerotmp files from interrupted downloads. Dry-run by default, --force

[3.5.2] - 2026-04-15
CLI Determinism, Performance Parity, Agent Safety & Multi-Agent Security Audit
Added
- Resume download (Range requests): Interrupted downloads can now resume from where they left off instead of restarting from scratch. New ResumableFile infrastructure preserves partial .aerotmp files on failure. Implemented across 17 HTTP-based providers: S3, Azure, WebDAV, Google Drive, OneDrive, Dropbox, Box, pCloud, Yandex Disk, Jottacloud, kDrive, Zoho WorkDrive, FileLu, OpenDrive, 4shared, Swift, Google Photos. Tested with 83% bandwidth savings on a 48 MB S3 file
- Resume in all transfer paths: Resume is active in single file download (GUI), folder download (batch executor with retry), CLI (--partial flag), AeroSync, and cross-profile transfers
- CLI path resolution logging: resolve_cli_remote_path logs to stderr whenever the profile base path is prepended, so agents and users always see the resolved path (e.g. Note: path 'data/' resolved to '/www.example.com/data/' (profile base: /www.example.com))
- CLI contextual connection errors: Connection failures now include actionable hints per error type (hostname/port, credentials, timeout/firewall, DNS resolution)
- CLI first-run guidance: No saved profiles found now suggests URL mode as alternative (aeroftp-cli ls ftp://user@host/path)
- CLI alias list feedback: alias list shows "No aliases configured" on empty instead of silent exit, and prints alias count on stderr
- CLI agent OpenAI-compatible tool calls: New ToolCallEcho and tool_call_id fields on ChatMessage enable proper tool call pairing for all OpenAI-compatible providers (Cohere, Groq, Together, Mistral, etc.). Previously only Anthropic format worked
- CLI vault AI provider resolution: --provider cohere (or any provider) now resolves API keys from the AeroFTP vault using the GUI-generated unique IDs, falling back transparently when env vars are not set
- ShareLink Phase 3 - Link Management: New "Manage" tab in ShareLinkModal shows existing share links with copy, open in browser, and revoke actions. Implemented list_share_links() for 8 providers: Dropbox, pCloud, Koofr, kDrive, Box, Zoho WorkDrive, Yandex Disk, Drime Cloud. ShareLinkCapabilities now advertises supports_list_links and supports_revoke
- CLI put with directory destination: put file.css /remote/assets/ now auto-appends the local filename instead of failing with "Is a directory"
- Complete exit code mapping: All 19 ProviderError variants now mapped to 12 distinct exit codes (0-11, 99, 130). New codes: 9 (AlreadyExists/DirectoryNotEmpty), 10 (ServerError/ParseError), 11 (IoError). Agents can now distinguish every error category without parsing messages
- mkdir --parents (-p): Idempotent recursive directory creation. No error if directory exists. Falls back to stat() probe for providers that don't return AlreadyExists
- rm --force idempotent delete: -f flag now suppresses NotFound errors (exit 0 instead of exit 2). Also handles FTP/WebDAV servers that return ServerError with "not found" in the message instead of typed NotFound
- put --no-clobber (-n): Skip upload if remote file already exists. Returns exit 9 with JSON {"status":"skipped","reason":"already_exists"}. No overwrite, no ambiguity
- --chunk-size / --buffer-size global flags: Override upload chunk and download buffer sizes per-session. S3 multipart part size (default 5 MB, cap 512 MB), SFTP/FTP buffer (default 32/8 KB, cap 16 MB). Configurable in ~/.config/aeroftp/config.toml
- S3 multipart parallel upload: Upload parts execute concurrently via tokio::spawn (4 parts in-flight). S3Provider derives Clone (reqwest::Client is Arc-based, clone is free). Batched disk pre-read overlaps I/O with network
- Azure Blob server-side copy: New server_copy() using Azure Copy Blob API (x-ms-copy-source header). Path resolution via resolve_blob_path() prevents prefix bypass. Content-Length: 0 header for Azure compliance
- CLI path traversal prevention: resolve_cli_remote_path() now rejects .. path components wi

[3.5.1] - 2026-04-14
S3/MEGA streaming fix, cross-provider timeout, protocol switch, security hardening
Added
- InfiniCLOUD REST API v2 dual connector: New connection mode selector (WebDAV / REST API). REST API mode enables auto-discovery of the user's node server and real-time storage quota via InfiniCLOUD's Muramasa API. Currently available for developers and internal beta testing
- Protocol switching for saved connections: Edit a saved FTP connection and switch between FTP, FTPS, and SFTP without recreating it. Port updates automatically. Resolves #108
- Delete confirmation dialog for saved servers: Deleting a saved server now shows a warning dialog with Cancel/Delete instead of deleting immediately. Fixes silent deletion on Linux (WebKitGTK does not support window.confirm)
- Remote/local paths in server list view: Saved servers with default paths now show them on two compact rows (remote + local) in the list view, truncated from the start for long paths
- InfiniCLOUD added to Special Thanks for responsive technical support and API key issuance
Added
- Internxt Trash Manager: View deleted files on Internxt (read-only, listing only)
- Azure Blob Trash Manager: View and restore soft-deleted blobs on Azure Blob Storage
- Zoho WorkDrive versioning enabled: supports_versions() now correctly returns true, enabling version management for Zoho files
- LargeIconsGrid virtualization: Grid view now uses react-virtuoso for smooth performance with 10,000+ files
Fixed
- Cross-provider transfer timeout (critical): All 22 cloud providers had a global request timeout (30s) that killed any transfer taking longer than 30 seconds. Replaced with connect timeout (30s) + read timeout (300s) across S3, Azure, WebDAV, OneDrive, Dropbox, Google Drive, Box, pCloud, Filen, Zoho, 4shared, Google Photos, Yandex, MEGA, Internxt, FileLu, Jottacloud, kDrive, OpenDrive, Koofr, Drime, Immich, GitHub, GitLab. Transfers of any size now complete as long as data flows
- MEGA Native streaming download/upload: Download and upload loaded entire files into memory (3x file size on download, 2x on upload), causing out-of-memory crashes on files larger than ~700 MB. Rewritten to stream through MEGA chunk boundaries with AES-128-CTR encryption in-place. Peak memory now 1 MB regardless of file size
- MEGA Native security hardening: Implemented Drop trait for automatic zeroization on provider drop. RSA private key components (BigUint), decrypted node keys, and session IDs now zeroized in clear_runtime_session. Replaced timing-vulnerable == comparison in verify_tsid with subtle::ConstantTimeEq
- MEGA batch permanent delete: Rapid sequential deletes could produce non-JSON responses from MEGA API, causing parse errors. Now tolerates parse errors on delete (node likely already removed)
- Azure Blob trash 403 error: list_deleted_blobs and undelete_blob were missing x-ms-date and x-ms-version headers, causing AuthenticationFailed on Shared Key accounts
- Protocol switch in IntroHub edit (#108): Switching between FTP, FTPS, and SFTP while editing a saved server now works correctly. Form data (server, username, password, paths) preserved, only protocol and port change. SourceForge preset hidden from switch selector
- IntroHub tab label: Tab now shows the connection name typed by the user (highest priority), falls back to server hostname, then to default provider label
- S3 large file download/upload timeout: The 30-second global request timeout caused downloads and multipart uploads to fail on files larger than ~200 MB across all S3-compatible providers (Storj, AWS, Backblaze, Wasabi)
- GitHub/GitLab context buttons disappearing on tab switch: Version counter prevents stale async responses from overwriting GitHub context state
- InfiniCLOUD REST API header: Corrected from X-InfiniCLOUD-API-KEY to X-TeraCLOUD-API-KEY per official documentation
- InfiniCLOUD quota not displaying: Fixed race condition where fetchStorageQuota was called before React state updated with the new session

[3.5.0] - 2026-04-13
Profile Bridge hub, FileZilla import/export, Nextcloud auto-detect, transfer engine fixes
Added
- FileZilla import/export bridge: Import sites from FileZilla sitemanager.xml and export back. Supports FTP, SFTP, FTPS (implicit and explicit), and S3. Passwords decoded from base64 and upgraded to AES-256-GCM encrypted vault. GUI and CLI (aeroftp import filezilla)
- Unified Bridge interface: Single "Bridge" section in Export/Import with app selector (rclone, WinSCP, FileZilla) instead of separate sections per tool. Contextual modal titles ("Import from rclone", "Export to FileZilla")
- FileZilla Bridge documentation: New page at docs.aeroftp.app/features/filezilla
Fixed
- Nextcloud WebDAV auto-detection: When connecting to a Nextcloud/ownCloud server without specifying the WebDAV path, AeroFTP now automatically discovers /remote.php/dav/files/{username}/ or /remote.php/webdav/ instead of failing with 405 on root. No manual path configuration needed. Follow-up to #95
- Large files in folder transfers timing out: Transfer timeout was fixed at 30 seconds regardless of file size. A 70MB file at 1MB/s would always timeout and restart from zero. Timeout now scales with file size (2s per MB + 30s base). Reported in #73
- "Skip if identical" skipping all files: The folder merge dialog sent merge_skip_identical but the backend only recognized skip_if_identical. Backend now accepts both naming conventions. Reported in #73
- Retry queue stuck in pending: Clicking "Retry All Failed" did nothing because retry callbacks were cleared when the batch completed. Callbacks are now preserved for failed items. Reported in #73
- AeroSync crash on compare with differences: An unexpected comparison status caused an undefined property access. Added fallback for unknown status values. Reported in #73
- Hover animation shifting files right: Removed translateX(2px) on table row hover that caused distracting rightward shift. Reported in #73
- Drag and drop interfering with rename: Dragging is now disabled while a rename input is active, allowing normal text selection. Reported in #73
- Parent folder single-click inconsistency: The ".." parent folder entry now requires double-click, consistent with regular folders. Reported in #73
- Font size not scaling on titlebar buttons: Disconnect, Write a Review, and Connect buttons used hardcoded pixel sizes. Now use scalable text-xs that respects the font size setting. Reported in #73
- Ukrainian and Russian "Write a Review" button: Fixed Latin transliteration to proper Cyrillic text. Reported in #73
Improved
- README Bridge section: Unified comparison table for all three bridge tools (rclone, WinSCP, FileZilla) with protocol count, password handling, and docs links
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.4.8] - 2026-04-10
Cross-profile transfer hardening, CLI doctor workflows, public docs alignment
Added
- CLI reconcile command: New aeroftp-cli reconcile --profile NAME ./local /remote --json returns categorized local-vs-remote diffs for automation and agent workflows, including missing-local, missing-remote, and mismatch groups
- CLI doctor workflows: Added sync-doctor and transfer-doctor preflight commands with structured checks, risk summaries, and suggested_next_command output so agents and scripts can move from inspection to execution without guesswork
- CLI transfer command: Cross-profile copy between two saved vault-backed profiles is now available from the CLI, including dry-run planning, recursive copy, and --skip-existing support for backup-style flows
- CLI agent-bootstrap: New task-oriented bootstrap entrypoint for AI agents with canonical workflows for explore, verify-file, transfer, backup, and reconcile scenarios
- Cross-profile transfer launcher in the GUI: Added a dedicated toolbar button near AeroCloud and AeroFile, opening the new profile-to-profile transfer panel without relying on hidden entry points
Fixed
- Zoho WorkDrive 429 rate limit: Rapid uploads followed by directory navigation would trigger HTTP 429 (Too Many Requests) from Zoho API, causing all subsequent operations to fail. Added automatic retry with exponential backoff to list, mkdir, delete, and rename operations
- GitLab 429 handling: GitLab API requests now retry automatically on rate limit (429) and server errors (5xx) instead of failing immediately
- Swift/Blomp retry: OpenStack Swift requests now retry on 429/5xx before and after re-authentication
- Cross-profile FTP default directory: Profile-backed FTP transfers now honor the saved remote root automatically, preventing copy plans from starting in the account root on hosting setups where the writable site folder lives under a preset directory such as www.domain.tld
- Cross-profile queue never completing: Fixed a root-cause event contract bug where file_start and file_complete used different paths for the same file, leaving queue entries stuck in transferring state and keeping the streaming UI alive after a completed transfer
- Cross-profile queue cleanup hardening: Added defensive frontend cleanup for orphan queue rows and pending file logs on complete, error, and cancelled, so late or mismatched events no longer leave the desktop under unnecessary load
Improved
- Cross-profile modal redesign: Replaced the blocking overlay-style dialog with a floating, taller, narrower panel so the queue, activity log, and progress bars remain visible while a transfer is running
- Profile selection UX: Profile rails now use the same icon style as Saved Servers with favicon, custom icon, and protocol gradient support, plus protocol badges matching the rest of the app
- Transfer execution state: The running state now uses a themed animated bar spinner and clearer plan/execute/done transitions, making long-running cloud-to-cloud transfers easier to monitor
- Cross-profile event typing: The frontend transfer event contract now explicitly includes cross-profile, improving consistency between backend events, queue state, and TypeScript surfaces
- Select field padding: Fixed clipped text in Location and Region dropdowns across protocol configuration forms
- Modal corner consistency: Health Check and Cross-Profile modals now use rounded-lg matching the Settings panel style
Changed
- Cross-profile panel i18n: Moved the new panel's static text to English source keys and translated all 28 keys across 46 locales through the batch translation workflow
- rclone appendix closure: Updated the internal appendix and backlog documents to reflect the real implementation state, marking cross-profile post-MVP work as substantially closed and moving optional Tier 3 items back to general backlog
- Public documentation refresh: Updated README.md, docs/CLI-GUIDE.md, AGENTS.md, and SECURITY.md, plus the public docs site pages for

[3.4.7] - 2026-04-09
rclone import/export, MEGA default fix
Added
- rclone config import: Import server profiles directly from rclone.conf files. Auto-detects config path, supports 17 rclone backend types (FTP, SFTP, S3, WebDAV, Google Drive, Dropbox, OneDrive, MEGA, Box, pCloud, Azure Blob, Swift, Yandex Disk, Koofr, Jottacloud, Backblaze B2, OpenDrive). Passwords are de-obfuscated from rclone's reversible AES-256-CTR scheme and stored in AeroFTP's AES-256-GCM encrypted vault
- rclone config export: Export server profiles to rclone.conf format for use with rclone CLI. Passwords are obfuscated using rclone's standard scheme for full compatibility
- CLI import rclone subcommand: aeroftp import rclone [path] [--json] for headless rclone config scanning with structured JSON output
- rclone UI in Export/Import dialog: New "rclone" section with Import and Export options, preview with server selection, OAuth re-auth notice, unsupported remotes listing
Fixed
- MEGA default mode: New MEGA profiles now default to Native API instead of MEGAcmd. Existing profiles without an explicit mode are treated as Native API in the UI and backend, preventing incorrect "MEGAcmd" labels on profiles that were never configured for it
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.4.6] - 2026-04-09
Transfer toast redesign, folder overwrite fix, session tab fix
Fixed
- Folder upload overwrite: Uploading a folder to an existing remote directory no longer fails with error 550 "Can't create directory: File exists". The mkdir call now gracefully ignores "already exists" errors for all providers and FTP
- Session tab not clickable from AeroFile: Clicking the active server tab while in AeroFile mode now correctly switches back to the remote file panel. Previously the tab appeared inactive (no pointer cursor) and clicks were ignored
- Transfer speed not displayed: Provider transfers (S3, WebDAV, etc.) now show real-time speed (KB/s, MB/s) and ETA in the transfer toast. Previously all provider transfers showed "Transferring..." with no speed data
- Folder transfer changes remote directory: After uploading or downloading a folder on providers, the view no longer navigates into the last subdirectory. The provider working directory is now saved before the operation and restored after completion
Improved
- Unified transfer toast: Removed the per-channel progress visualization in favor of a single, stable progress bar for all transfer types. The toast now shows the same clean layout (filename, speed, ETA, file count) regardless of protocol or concurrency level. No more layout jumps from channels appearing and disappearing
- Aggregated folder transfer speed: The main progress bar during folder transfers now shows the combined speed from all active transfer lanes
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.4.5] - 2026-04-08
AppImage cross-distro fix, window resize, editor languages
Fixed
- AppImage EGL crash on Arch/Fedora (issue #90): Stripped all 166 bundled shared libraries from AppImage to resolve EGL_BAD_PARAMETER and cascading undefined symbol errors on rolling-release distros. The AppImage now uses system libraries at runtime, matching the .deb and AUR approach. Reduced AppImage size from 118 MB to 48 MB. Tested on EndeavourOS with KDE Wayland and Hyprland
- Window resize on Linux: Added client-side resize handles (WindowResizeEdges) for undecorated windows on Wayland and X11. Uses pointer capture with movementX/movementY deltas for reliable vertical and diagonal resize. Linux-only - Windows and macOS use native resize zones
- Minimum window height: Lowered from 800px to 600px to support 768p laptop screens
- Quotaless contact badge: Removed incorrect contactVerified flag (no response received)
Added
- 80+ editor languages (issue #91): Monaco editor now maps all built-in languages including Lua, Kotlin, Dart, Swift, Elixir, Scala, Clojure, C#, F#, PowerShell, HCL/Terraform, Protobuf, Solidity, SystemVerilog, Julia, Perl, R, and more. Any recognized file extension is also auto-previewable
- Koofr contact badge: Added contactVerified for Koofr (active support relationship)
- Jottacloud contact badge: Added to contactProtocols for OAuth provider disclaimer
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.4.4] - 2026-04-07
Immich provider, Media Services category, transfer infrastructure
Added
- Immich provider: Native integration with Immich self-hosted photo management via REST API (1427 lines). Browse albums, upload/download, delete (soft trash), create albums, search, share links, SHA-256 checksum. API key auth, zero OAuth required
- PixelUnion preset: EU-hosted Immich cloud (16 GB free) with dedicated connection form, subdomain-based URL, featured in Discover Services
- Media Services category: New Discover panel category with Camera icon for photo/video management services
- Immich CLI support: Full aeroftp-cli --profile support for Immich protocol - connect, ls, put, get, find, mkdir, rm, stat, link, hashsum
- Immich UI protections: Rename, batch rename, cut/move, and nested mkdir automatically disabled for Immich connections
- Transfer event bridge: SyncPanel uses DOM CustomEvent bridge for transfer progress, decoupling from direct Tauri listener
- FTP timeout configuration: Structured FtpTimeoutConfig with per-operation timeouts (connect, list, command, upload, disconnect)
- Connection settings: Timeout, max concurrent transfers, and retry count exposed in settings panel
- Transfer orchestrator: New transfer_orchestrator.rs module for parallel transfer coordination
- FTP session pool: New ftp_session_pool.rs for connection pooling in parallel transfers
Fixed
- Immich file sizes: Use fileSizeInByte field from Immich EXIF data (was showing 0 bytes)
- Immich search: Client-side filename filtering from [All Assets] (API metadata search is exact-match only)
- Immich upload in root: Files uploaded to root now go to All Assets instead of failing with "Album not found"
- CLI download to directory: get command with trailing / destination now appends remote filename instead of failing
- CLI Immich protocol: Added "immich" to CLI protocol mapping
Changed
- Provider registration audit: Added immich to all provider lists across frontend and backend
- Documentation: Updated README provider grid, PROTOCOL-FEATURES.md, PROVIDER-INTEGRATION-GUIDE.md, docs.aeroftp.app with 2 new provider guides and Photo & Media category
- i18n: 10+ new keys translated across all 47 locales
- Dependencies: Updated Tauri plugins, removed orphan russh-keys; bumped tokio, crossterm, react-virtuoso, libc, semver
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.4.3] - 2026-04-06
AeroSync advanced controls, archive security, provider trash management
Added
- AeroSync conflict strategy: Automatic conflict resolution with configurable strategy per profile — newer, older, larger, smaller, skip, or ask per file
- AeroSync delete orphans: Option to delete files on the destination that no longer exist on the source, with versioning backup strategies (trash can 30 days, keep last 5, staggered hourly/daily/weekly, or disabled)
- AeroSync rename detection: SHA-256 based rename detection identifies moved/renamed files instead of re-transferring them
- AeroSync file filters: Min/max file size and min/max file age filters to control which files are included in synchronization
- AeroSync bandwidth schedule: Preset schedules for bandwidth throttling during office hours (08-18) or night mode (18-08) at 512 KB/s
- AeroSync transfer budget: Configurable total data limit per sync session (100 MB to 50 GB) — sync stops when the budget is exhausted
- AeroSync snapshot rollback: Full restore from snapshot with confirmation dialog showing file count to re-download (previously "coming soon")
- AeroSync delete safety confirmation: Overlay warning showing the exact number of files that will be permanently deleted before sync proceeds
- AeroSync pre-delete archival: Automatic backup of deleted files to .aeroversions/ with 30-day retention before removal during pull sync
- AeroSync custom profile card: QuickMode now shows a "Custom" card when settings do not match any preset profile
- AeroSync bisync delete detection: previously_synced field distinguishes true deletions from new files in bidirectional sync
- Box.com trash management: Restore from trash, permanent delete from trash, move items between folders
- Box.com collaborations: List and add collaborations for shared folder management
- Box.com folder locks: List folder locks (Box File Governance)
- Provider trash commands: Trash listing and empty trash for Zoho, MEGA, OpenDrive, Yandex, pCloud, KDrive
- Archive password support: Browse and extract password-protected ZIP archives, 7z archive support (sevenz_rust), TAR/TAR.GZ/TAR.BZ2/TAR.XZ browsing
- Provider commands module: Extracted provider-specific Tauri commands into dedicated provider_commands.rs for better code organization
- CLI remote bind authentication: --allow-remote-bind flag with auto-generated auth tokens for daemon, serve HTTP/WebDAV/FTP/SFTP when binding to non-loopback addresses. Configurable via AEROFTP_DAEMON_TOKEN and AEROFTP_SERVE_AUTH_TOKEN env vars
Fixed
- Archive path traversal prevention: Reject archive entries containing .. components, absolute paths, or Windows drive prefixes during extraction
- Archive atomic extraction: Files are extracted to a .aerotmp temporary path and renamed on completion, preventing partial data on interrupted extractions
- API key leak prevention: Regex-based sanitization strips API keys (Google, Anthropic, OpenAI, Bearer tokens, x-api-key headers) from error messages before they reach the UI
- Plugin integrity verification: SHA-256 hash check for plugin tools and hooks — execution is skipped if files have been modified. Shell metacharacters in hook commands are rejected
- Shell denylist expansion: Added crontab, nohup, systemctl, service, mount, umount, fdisk, parted, iptables, useradd, userdel, passwd, sudo, pkill, killall to the AI shell command denylist
- MCP tool argument validation: Centralized validate_tool_args() with path sandbox checks for all MCP tool operations
- MCP rate limiting by category: File operations, metadata queries, and compute tasks now have separate rate limit buckets
- Post-update toast: Now shows the updated version number instead of repeating the SHA-256 hash
- Pre-restart overlay: Shows SHA-256 hash as plain text instead of a colored verification badge (verification badge remains in the download toast)
Changed
- i18n: 40 new keys added across all 47 languages for AeroSync advanced controls
- Code formatting: Consistent 

[3.4.2] - 2026-04-05
CLI Pro: mount, ncdu, serve FTP/SFTP, daemon, crypt overlay, bisync
Added
- Bisync snapshot persistence: sync --direction both now saves state to .aeroftp-bisync.json after successful sync. Subsequent syncs use delta detection (size + mtime) to identify changes on each side, enabling safe bidirectional synchronization
- --conflict-mode flag: Configurable conflict resolution for bidirectional sync. Modes: newer (default), older, larger, smaller, skip. When both sides have different content, the chosen strategy determines which side wins
- --resync flag: Discard previous bisync snapshot and rebuild from scratch. Useful for recovery after interrupted syncs or state corruption
- Snapshot-based deletion detection: In --direction both --delete, files that existed in the previous snapshot but are now missing on one side are correctly detected as deletions and propagated to the other side
- --backup-dir and --backup-suffix: Move local files to a backup directory before overwriting or deleting during sync (previously accepted but ignored)
- --max-transfer flag: Abort CLI session after transferring a configurable byte limit (e.g. --max-transfer 10G). Counts uploads and downloads combined. Exit code 8 when exceeded, in-flight transfers complete before stopping
- --retries N flag: Automatic retry for failed transfer operations (get, put, sync). Default 3 attempts. Non-retryable errors (auth failure, usage error, unsupported) are never retried
- --retries-sleep flag: Configurable delay between retries (e.g. --retries-sleep 5s, 1m, 500ms). Default 1 second
- --max-backlog flag: Limit the number of queued transfer tasks in parallel operations. Default 10000
- --dump flag: Connection debug diagnostics to stderr. Supports headers, bodies, auth (comma-separated). Passwords are redacted by default, visible only with --dump auth
- All new flags are persistable as defaults in ~/.config/aeroftp/config.toml
- ncdu interactive disk usage explorer: New aeroftp ncdu command scans remote directories recursively and displays an interactive TUI (ratatui) with size bars, percentage breakdown, and keyboard navigation. Supports --export file.json for scripting and --json for piped output. Scan depth configurable with -d
- mount virtual filesystem (cross-platform): New aeroftp mount <mountpoint> mounts any remote as a local filesystem. On Linux/macOS uses FUSE with full read-write support (create, write, mkdir, rm, rmdir, rename, statfs). On Windows uses a WebDAV bridge that maps to a drive letter (aeroftp mount Z: --profile "MyServer"). Features: --read-only flag, metadata cache with configurable TTL (--cache-ttl), range read with fallback, --allow-other for multi-user access, graceful unmount. Tested on 8 providers across S3, FTP, WebDAV, and MEGA
- serve ftp: New aeroftp serve ftp exposes any remote as a local FTP server via libunftp. Full read-write: LIST, RETR, STOR, DELE, MKD, RMD, RNFR/RNTO, CWD. Anonymous access, configurable passive port range (--passive-ports). Any FTP client can now access S3, WebDAV, MEGA, or any other AeroFTP provider as if it were a standard FTP server
- Background daemon and job queue: New aeroftp daemon start/stop/status runs a background service with HTTP RC API on localhost. aeroftp jobs add/list/status/cancel manages persistent transfer jobs via SQLite. Health monitoring via curl http://localhost:14320/health. Enables persistent mounts, scheduled transfers, and automation
- Crypt overlay — zero-knowledge encryption: New aeroftp crypt init/ls/put/get provides transparent encryption on any provider. Content encrypted with AES-256-GCM (64KB blocks, HW accelerated), filenames encrypted with AES-256-SIV, key derivation via Argon2id (64MB, 3 iterations). The cloud provider never sees your file names or content. Overhead: ~33 bytes for small files, <0.1% for large files
- serve sftp: New aeroftp serve sftp exposes any remote as a local SFTP server via russh. Full SFTP v3 protocol: LIST, STAT, READ, WRITE, REMO

[3.4.1] - 2026-04-05
FTPS implicit fix, Azure health check, SourceForge in About
Fixed
- FTPS implicit TLS on port 990: Connections to CerberusFTP and other implicit FTPS servers were timing out because the client used the explicit TLS upgrade path (AUTH TLS) instead of establishing TLS immediately on connect. Switched to connect_secure_implicit() which wraps the connection in TLS right after TCP (#80)
- Azure Blob health check: The probe URL blob.core.windows.net is not a valid hostname (requires account prefix). Replaced with Microsoft OpenID discovery endpoint in both backend and Discover panel
Added
- SourceForge links in About dialog: Support tab now includes SourceForge repo button and review link, matching the existing GitHub button style (47 languages)
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.4.0] - 2026-04-05
Google Cloud Storage, S3 HTTP/2 fix, translated Discover descriptions
Added
- Google Cloud Storage provider: Dedicated preset in Discover panel with HMAC interop endpoint, path-style URLs, multi-region selector, and official logo
- Translated Discover descriptions: All 59 provider descriptions in the Discover panel and Command Palette are now translatable via i18n (46 languages)
- Vault category breakdown: Backup tab shows entry composition (e.g. "87 credentials - 8 AI keys - 26 OAuth - 12 config") alongside the total count
- Azure Blob health check: Added blob.core.windows.net endpoint for status monitoring in Discover panel
Fixed
- S3 HTTP/2 protocol error: Forced HTTP/1.1 on the S3 client to fix PROTOCOL_ERROR RST_STREAM when connecting to Google Cloud Storage and other endpoints that reject HTTP/2 on S3 interop API
- Keystore import now restores deleted servers: Import with "skip existing" merges server profiles by ID instead of skipping the entire list, so deleted servers are properly restored from backup
- Vault entry count accurate after import: Re-queries actual vault status instead of optimistic sum that could drift
- Server deletion cleans up vault credentials: Removing a server now also deletes its orphaned server_<id> credential from the vault
- Import progress feedback: Real-time progress bar with "Decrypting..." and "Importing 34/134..." phases via Tauri events, replacing the generic spinner
- Server profiles reload after keystore import: Imported profiles are immediately visible without app restart
Changed
- Discover S3 provider order: Reordered to group by tier (generic/decentralized, major cloud, mid-tier, regional)
- Privacy tab: Removed unused analytics toggle and tracking language. AeroFTP collects zero data - the privacy page now clearly states this
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.3.9] - 2026-04-04
TLS session reuse fix for CerberusFTP & strict servers
Fixed
- TLS session reuse on data connections: Capped FTP TLS to version 1.2 to fix session reuse failures on CerberusFTP and other strict servers. TLS 1.3 tickets are single-use, so the second data connection would resume a different session than the control channel, violating RFC 4217 section 10.2. TLS 1.2 session-ID resumption is non-destructive and correctly resumes the same session on every data connection (#78)
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.3.8] - 2026-04-04
Windows TLS certificate fix & InfiniCloud UX cleanup
Fixed
- Windows TLS certificate validation: Fixed UnknownIssuer error when connecting to servers with Let's Encrypt certificates on Windows. The FTP TLS connector now loads the native OS certificate store (Windows/macOS/Linux) in addition to bundled Mozilla roots, so system-trusted CAs and enterprise certificates are properly recognized (#79)
- InfiniCloud form cleanup: Hidden the API Key field from the InfiniCloud connection form until REST API access is available. WebDAV connection works without it
- Select field height: Protocol-specific dropdown menus (Encryption, S3 region/endpoint) now match input field height consistently
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.3.7] - 2026-04-04
Demo servers, provider URL fixes & Discover UX improvements
Added
- Rebex demo servers: Two pre-configured read-only demo servers (FTP and SFTP) in the Discover > Protocols tab with DEMO badge. Click to open a pre-filled connection form - no configuration needed to try AeroFTP immediately
- InfiniCloud REST API module: Backend support for InfiniCloud REST API v2 (Muramasa) with automatic node discovery and storage quota. Dormant until API key is received from InfiniCloud (WebDAV connection works as before)
Fixed
- Provider signup/help URLs: Corrected broken registration and help links for InfiniCloud, FileLu, Koofr, Quotaless, and FeliCloud
- Cryptomator capability description: Fixed documentation and AI knowledge base incorrectly stating Cryptomator support is read-only. AeroFTP can both create and browse Cryptomator format 8 vaults
- AeroFile in View menu: Added missing AeroFile entry in the View menu
- Update toast i18n key: Fixed missing translation key for update notification
- Unverified certificate badge: Replaced alert triangle with subtle shield icon for TLS connections with unverified certificates
Improved
- Redirect after save: Saving a new connection now automatically switches to the My Servers tab
- Azure Blob placement: Moved Azure Blob Storage from Protocols to S3 / Object Storage section in Discover
- DEMO badge in saved servers: Rebex demo connections show an amber DEMO badge alongside the protocol badge
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.3.6] - 2026-04-04
FTPS TLS session reuse, rustls migration & server badge overhaul
Fixed
- FTPS TLS session reuse (Issue #78): Servers requiring TLS session resumption (CerberusFTP, vsftpd require_ssl_reuse=YES, FileZilla Server, ProFTPD) now work correctly. Migrated TLS backend from native-tls to rustls, which automatically caches and resumes TLS sessions on data connections per RFC 4217. Previously failed with 522 SSL connection failed: session reuse required
- Saved server host:port duplication: Servers saved with non-default ports (e.g. 2121) had the port appended to the hostname, causing host:port:port double-port errors on reconnect. Backend now strips port suffix from hostname, and frontend no longer concatenates host:port in saved server params
- FTP TLS mode not applied from saved servers: Saved FTP connections with "Require explicit FTP over TLS" would reconnect as plain FTP because tls_mode defaulted to undefined instead of explicit. Both buildProviderParams paths now default FTP protocol to explicit TLS
- Missing common.duplicate i18n key: Added missing translation key that caused infinite warning loop in console. Propagated and translated across all 47 locales
Improved
- Server card protocol badges: FTP/SFTP/FTPS badges now color-coded - FTPS emerald green, SFTP teal, plain FTP amber. Previously all gray
- Server card TLS security indicator: Shield icon (green) shown for verified TLS/SSH connections, alert triangle (gray) for connections with certificate verification disabled
- TLS mode persistence: Encryption dropdown default (explicit for FTP, implicit for FTPS) now persisted on save even when the user doesn't touch the dropdown
Changed
- TLS backend: Replaced native-tls (OpenSSL/SChannel/SecureTransport) with rustls for FTP/FTPS connections. Enables TLS 1.3 session tickets and TLS 1.2 session ID resumption. Cross-platform pure-Rust implementation with no system OpenSSL dependency for FTP
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.3.5] - 2026-04-03
CLI serve HTTP/WebDAV, GitLab Tier 1, rclone parity, streaming transfers & UX polish
Added
- Native MCP server mode: aeroftp-cli agent --mcp now runs a real Model Context Protocol server over async stdio. Exposes 16 curated remote tools, profile/resources discovery, reusable prompts, connection pooling, rate limiting, and audit logging for Claude Desktop, Cursor, VS Code, and other MCP clients
- AI stream cancellation: Users can now stop a stuck AI generation at any time. Backend uses tokio::select! with wait_for_cancel() polling every 200ms - works even when the stream is completely blocked (e.g. Ollama models hanging). Global ACTIVE_STREAMS registry with Arc<AtomicBool> per stream. New ai_cancel_stream Tauri command. Frontend shows a filled square Stop button during any streaming, not just multi-step auto-execution. Conversation switching also cancels backend streams (previously only stopped frontend listening)
- Agent mode quick-switch dropdown: Copilot-style dropdown in AeroAgent chat header for instant mode switching between Safe, Normal, Expert, and Extreme. Shows current mode with colored icon + description. Replaces the old badge that only opened settings. Extreme mode locked to Cyber theme with warning
- Anthropic prompt caching (3 levels): Full prompt caching implementation for Anthropic provider - system prompt (already existed), tool definitions (new - caches all 47 tool defs via cache_control on last tool), and multi-turn conversation history (new - cache_control on last user message). Applied to both streaming and non-streaming paths. Up to 90% cost reduction on long conversations
- GitLab Releases browser: Full release management modal with list, create, delete, upload/download assets. Assets uploaded via Generic Packages API and linked to releases. Source archives (zip/tar.gz) with direct download. Orange-branded UI with Tag icon in toolbar
- GitLab asset download: Authenticated backend download via PRIVATE-TOKEN header. Works for private repositories (no browser redirect needed)
- GitLab Merge Requests: Create MR from non-default branches with "MR" button in status bar. Auto-detects existing open MR. Guard prevents source==target branch MR
- GitLab write mode: Three-state model (direct/branch/readonly). Status bar shows "Direct" on default branch, branch name + MR button on feature branches, "Read-only" without push access
- GitLab View on GitLab: gitlab_get_web_url command builds encoded web URLs for files and directories
- GitLab CHANGELOG import: Import release notes from CHANGELOG.md in Create Release form. Always reads from repo root regardless of current navigation path
- GitLab self-hosted TLS: Accept self-signed certificates toggle for self-hosted instances (appears when host is not gitlab.com)
- GitLab form improvements: Branch field, token creation link, remote/local path fields, save connection with icon picker
- CLI serve http: Expose any remote as a local read-only HTTP server. HTML directory listing with navigation, file download, HEAD without download, range requests (HTTP 206 Partial Content with Content-Range), Accept-Ranges: bytes, MIME type guessing, path traversal protection, graceful Ctrl+C shutdown. Supports all 27 providers via URL or --profile. See APPENDIX-W
- CLI serve webdav: Expose any remote as a local read-write WebDAV server. PROPFIND (Depth 0/1, XML DAV: namespace), GET, HEAD, PUT (512 MB cap), DELETE (file + directory), MKCOL, MOVE, COPY (native server_copy or download+upload fallback), OPTIONS with DAV header. Reuses path primitives and state from serve http
- Provider range download: read_range(path, offset, length) for FTP (REST + bounded RETR), S3 (Range header, 206/200 handling), and WebDAV (Range header with server-ignoring fallback). 100 MB per-request safety cap. New supports_range_download flag in TransferOptimizationHints
Fixed
- MCP request cancellation semantics: notifications/cancelled now cancels real in-flight requests and suppresses late res

[3.3.4] - 2026-04-03
Ollama fix, update verification & restart reliability
Fixed
- Ollama models not appearing in chat dropdown: API key check now correctly skips Ollama (local provider, no key needed). Models appear in selector and tool calls work
- Ollama "Missing API Key" warning: Status indicator in AI Settings now shows green for Ollama instead of amber "Missing API Key"
- Ollama "API key not configured" error on chat: Message send flow now bypasses keyring lookup for Ollama providers
- Update verification indicator: SHA-256 verified releases now show green ShieldCheck badge instead of amber "Unverified release" warning
- App restart after update: Replaced fixed 5-second sleep with PID-polling (waits for process to actually exit). Works reliably on both fast and slow machines. Three fallback layers: helper script, setsid inline, pre_exec inline
Changed
- AI model auto-import: Tools capability now enabled by default for all auto-imported models (was disabled, breaking AeroAgent tool calls)
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.3.3] - 2026-04-02
GitLab integration, provider dashboard & form polish
Added
- GitLab provider: Full repository browsing via REST API v4. Connect to gitlab.com or self-hosted instances with Personal/Project Access Tokens. Supports browse, upload, download, mkdir, delete, rename with atomic batch commits via native REST (no GraphQL needed). Includes branch selector, commit dialog, write mode indicator, and context menu with tanuki icon
- GitLab in CLI: gitlab:// URL scheme support in aeroftp-cli, agent server_exec support, protocol dispatch
- Provider health check dashboard: Progressive wave scan of provider endpoints (S3, WebDAV, API) via Rust HEAD requests. Green/amber/red status dots on Discover service cards. Per-tab scanning with manual "Check" button. 5-minute cache, offline-safe, no retry loops
- Quotaless integration: S3 (MinIO path-style) and WebDAV (ownCloud) presets with health check, pre-configured endpoints, and contactVerified status
- Provider logos in connect buttons: All OAuth and API provider buttons show official logo instead of generic Cloud icon (MEGA, Google Drive, Dropbox, FileLu, etc.)
- AWS theme-aware logo: Dark mode uses white-text SVG, light mode uses dark-text SVG
- Hetzner Storage Box logo: PNG logo added to Discover and Saved Servers
- S3 Advanced Options: Endpoint and path-style fields hidden behind collapsible Advanced for all preset S3 providers (Backblaze, IDrive e2, Wasabi, Tencent, etc.). Edit button with warning modal to unlock preset fields
- WebDAV Advanced Options: Server/port fields locked with Edit + warning modal for preset WebDAV providers (Koofr, DriveHQ, CloudMe, Jianguoyun)
- Card footer: Provider connectVia + Create Account + Docs links in a full-width footer bar at bottom of form card with subtle background
- Provider disclaimer redesign: Two-line format - info icon + documentation line for all, green shield + direct contact line for verified providers
- Form tab context menu: Right-click on form tabs for Close, Close Others, Close All
- Form tab origin memory: Closing a form tab returns to the tab that opened it (Discover or My Servers)
- Badge counters: Pill-style badges on tab counters, sidebar categories, and filter chips
- Clock icon: Timer icon next to last-connected time in server cards
- Developer filter chip: New "Dev" filter in My Servers toolbar to quickly find GitHub/GitLab connections
- Font family selector: Choose interface font from presets or custom. Live preview in settings
- Font size slider: Continuous 10-22px range replaces the old 3-preset system
- Window state persistence: Window size, position, and maximized state saved between sessions
- Roadmap Appendix Q: Developer Services integration plan
- Roadmap Appendix R: UX Personalization plan
- Roadmap Appendix T: Provider Landing Pages plan and 33 setup guides on docs.aeroftp.app
Changed
- Form card styling: Calibrated border and shadow matching Discover/Saved Server mini-cards. Removed heavy shadow-xl in favor of subtle shadow-[0_1px_3px]
- Provider header removed in IntroHub: Redundant logo+name+description card removed; info moved to header right corner with description
- Input field heights unified: All fields (credentials, paths, connection name) use consistent py-2.5 matching OAuth reference
- URL placeholders prefixed: All endpoint/server placeholders now show "es." prefix to distinguish from entered values
- Connect button styling: Removed colored glow effects, added calibrated shadow, cursor-pointer on all buttons
- S3 provider ordering: S3 Compatible and MinIO first, then major providers, Asian providers last
- Cloud Storage ordering: Zoho before kDrive, Koofr before Jotta, Yandex last
- Tab styling unified: My Servers, Discover, and form tabs all share border+shadow style on active/hover
- Dashed border on + buttons: New connection buttons in IntroHub, session tabs, and local tabs use dashed border style
- pCloud button color: Changed from green to sky/cyan to match logo
- Backblaze B2 labels: F

[3.3.2] - 2026-04-01
GitLab integration, UX personalization & UI polish
Added
- GitLab provider: Full repository browsing via REST API v4. Connect to gitlab.com or self-hosted instances with Personal/Project Access Tokens. Supports browse, upload, download, mkdir, delete, rename with atomic batch commits via native REST (no GraphQL needed). Includes branch selector, commit dialog, write mode indicator, and context menu with tanuki icon (#73 follow-up)
- GitLab in CLI: gitlab:// URL scheme support in aeroftp-cli, agent server_exec support, protocol dispatch
- Developer filter chip: New "Dev" filter in My Servers toolbar to quickly find GitHub/GitLab connections
- Font family selector: Choose interface font from presets (Inter, FiraGO, JetBrains Mono, Noto Sans, system-ui) or enter any custom font. Live preview in settings. Supports multi-script users (Latin, Cyrillic, Georgian) (#73 - user feedback from Ar-Paramir)
- Font size slider: Continuous 10-22px range replaces the old 3-preset system (small/medium/large). All UI elements scale proportionally including toolbar, tabs, badges, and status bar (#73 - user feedback)
- Font reset button: One-click "Reset to defaults (Inter, 16px)" appears when font settings differ from defaults
- Window state persistence: Window size, position, and maximized state saved automatically between sessions using tauri-plugin-window-state. Splash screen excluded from state tracking. Restore happens after splash teardown to avoid visual glitch (#73 - user feedback)
- Provider identity in forms: Quick Connect header now shows provider logo and name aligned right (e.g. tanuki + "GitLab", FileLu logo + "FILELU")
- Roadmap Appendix Q: Developer Services integration plan - 8 services across 3 tiers (GitLab, Bitbucket, Gitea/Forgejo, Docker Registry, npm, Artifactory, Netlify, Vercel) with detailed API analysis and executive plan
- Roadmap Appendix R: UX Personalization plan - font customization and window state persistence
Changed
- FTP/FTPS unified in Discover: Single "FTP / FTPS" entry replaces separate FTP and FTPS cards
- FileLu brand color: Changed from violet to sky blue across all UI (ProtocolSelector, SessionTabs, SavedServers, ConnectionScreen) to match actual logo color
- Server cards floating style: Lighter borders with subtle shadow at rest and elevated shadow on hover for a floating card effect. Applied to both My Servers and Discover service cards
- Discover category persistence: Last visited category remembered in localStorage
- Discover search removed: Redundant search bar removed from services panel (sidebar categories are sufficient)
- Command Palette removed: Ctrl+K search overlay removed from IntroHub (redundant with filter chips and server search)
- Status bar truncation: Server info and write mode badges gracefully truncate on narrow windows. Button labels hide below 1100px width, leaving only icons
- Discover Services count: 49 to 50 (+GitLab)
Fixed
- Font scaling consistency: All UI elements now scale with font size setting via html root font-size. Previous implementation only affected inherited text; Tailwind rem-based classes (toolbar, tabs, badges) were fixed at browser default
- File list font size: Added explicit text-sm to remote and local file tables to prevent oversized text at default 16px root
- Write mode badge wrapping: "Direct push" / "Private" / "Read-only" badges no longer wrap to two lines on narrow windows
- Missing i18n key: activity.insecure_cert_enabled now properly translated in 47 languages (was showing raw key in activity log for FTP connections with certificate verification disabled)
- Clippy warnings: Resolved dead_code warnings in GitLab provider models
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage
Download AeroFTP

[3.3.0] - 2026-04-01
IntroHub - Complete intro page redesign
Added
- IntroHub tab system: New tabbed interface replaces the old 50/50 split layout. Two main tabs (My Servers, Discover) plus dynamic form tabs for editing/creating connections
- My Servers grid view: Saved servers displayed in a responsive 4-column card grid with provider icons, protocol badges, last-connected timestamps, and masked credentials
- My Servers list view: Alternative table-like view with columns (name, user/host, protocol, time) and zebra striping for readability
- Filter chips with counters: Quick filter by protocol type (All, FTP/SFTP, S3/Object, WebDAV, Cloud, Favorites) with real-time counts on each chip
- Favorites system: Star/unstar saved servers, filter by favorites, persisted in localStorage. Star visible on hover (unfavorited) or always (favorited) in top-right of card
- Discover Services catalog: 5 categorized sections (Protocols, S3/Object Storage, WebDAV & Self-hosted, Cloud Storage, Developer) with sidebar navigation and provider search
- Info banners: S3 and WebDAV categories show translated description banners (47 languages) explaining requirements
- Command Palette (Ctrl+K): Spotlight-style overlay with fuzzy search across saved servers, providers, and actions. Full keyboard navigation (arrows, Enter, Tab, Esc)
- Dynamic form tabs: Click a provider or Edit a server to open a dedicated form tab. Multiple tabs can be open simultaneously for side-by-side editing
- Form 2-column layout: FTP/SFTP/S3/WebDAV/Azure forms display connection fields (left) and paths/save/button (right) in a professional 2-column grid
- Health Check button: Restored in toolbar with original emerald color, opens ServerHealthCheck modal
- Export/Import button: Restored in toolbar with original amber color
- Server counters in tabs: My Servers tab shows total server count, Discover tab shows total service count
- Keyboard shortcuts: Ctrl+1 (My Servers), Ctrl+2 (Discover), Ctrl+N (New connection), Ctrl+K (Command Palette)
- renderRightColumn() helper: Shared function in ConnectionScreen for paths/save/button, reducing code duplication across protocol forms
- SourceForge integration: Native SourceForge SFTP provider enabled in production. Pre-configured connection to frs.sourceforge.net with Project (Unixname) field and auto-composed remote path. SSH key authentication with collapsible SSH Auth section
- Custom Checkbox component: Replaced all ~75 native HTML checkboxes across 23 files with animated SVG checkmark component (src/components/ui/Checkbox.tsx). Includes focus-visible ring, aria-label support, keyboard navigation
- Cloud provider descriptions: All 17 cloud services in Discover now show storage info and signup links
- Info banners for all categories: Protocols, Cloud Storage, and Developer categories now show informational banners (previously only S3 and WebDAV had them). Translated in 47 languages
- Collapsible SSH Authentication: SFTP SSH auth fields collapse by default, expand on click. Saves form space when using password auth
Changed
- Connection screen architecture: ConnectionScreen now supports formOnly mode (hides SavedServers panel, ProtocolSelector, and redundant buttons). Used by IntroHub form tabs
- Server badges: Protocol badges in saved servers now match original style (gray, rounded, uppercase, no icons). GitHub shows secondary badge (PAT/APP/OAuth), MEGA shows (API/CMD)
- Service badges in Discover: Use original ProtocolSelector colors (green for TLS/SSH/E2E with ShieldCheck, purple for OAuth with Lock, blue for API, orange for HMAC)
- Provider icons in Discover: No container box around icons (matching original ProtocolSelector style)
- Connect button: Click the server icon to connect (with spinner feedback), no separate Connect button. Matches original SavedServers UX
- Icon border: Server icons have a subtle border (border-gray-200 dark:border-gray-500) at rest, blue ring on hover
- Form buttons: All gradient buttons replaced with solid co

[3.2.6] - 2026-03-31
macOS static linking fix & security hardening
Fixed
- macOS crash at launch (DYLD / library not found): The macOS binary was dynamically linking against Homebrew's liblzma.5.dylib (/opt/homebrew/lib/), causing a DYLD crash at launch. Users without Homebrew got a missing library error; users with Homebrew could still crash due to library version mismatches. Now statically links liblzma into the binary, eliminating the external dependency entirely
- Security: HIGH vulnerability resolved (GHSA-q29p-9pfr-j652): Upgraded russh 0.57 to 0.59, which replaces libcrux-ml-kem/libcrux-sha3 with RustCrypto ml-kem, eliminating the vulnerable dependency from the tree
- Security: XSS SAST finding resolved: Removed dangerouslySetInnerHTML from GitHubReleaseBrowser, replaced with safe React element rendering
Changed
- Upgraded indicatif 0.17 to 0.18, removing unmaintained number_prefix dependency
- Cargo dependency update: 116 crate bumps including openssl, rustls, tao, wry
- SourceForge provider preset hidden until provider confirmation (dev-only)
- FeliCloud direct access: Clicking FeliCloud in the connection screen now goes directly to the connection form instead of routing through the WebDAV preset list
- FeliCloud badge: Uses Nextcloud blue (#0083ce) for API OCS badge in protocol selector and saved servers
- Saved servers WebDAV URL: Shortened to hostname only instead of full URL path
- Status bar panel consistency: File count indicators (remote/local) now match the visual panel order when panels are swapped
Security
- Aikido Security audit: Top 5% benchmark, 0 open issues across all categories
- Full compliance coverage: OWASP Top 10, ISO 27001, CIS v8.1, NIS2, GDPR
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[3.2.5] - 2026-03-30
Hotfix: Linux localhost bind regression
Fixed
- Linux connection refused on startup: v3.2.4 changed the navigation URL from localhost to 127.0.0.1 but tauri-plugin-localhost defaults to binding on localhost (which may resolve to ::1 IPv6 on some systems). The plugin now explicitly binds to 127.0.0.1 via .host("127.0.0.1"), matching the navigation URL. Fixes the "Could not connect to 127.0.0.1: Connection refused" error on Linux.
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[3.2.4] - 2026-03-30
macOS Frozen UI Fix & UI Polish
Fixed
- macOS frozen/unresponsive UI (critical): The app window rendered but was completely non-interactive on macOS Apple Silicon (M2, M3) across macOS 15.7 and 26.4 (Tahoe). Root cause: tauri-plugin-localhost was serving the frontend over http://localhost:14321 on ALL platforms, but this workaround is only needed for Linux WebKitGTK. On macOS, WKWebView's App Transport Security (ATS) silently blocked plain HTTP content loading, producing a visible but event-dead UI. Fix: localhost transport is now Linux-only; macOS and Windows use Tauri's native asset protocol (tauri://). Dual audit (internal + external) confirmed the root cause and fix strategy. See docs/dev/platform/MACOS-UNIFIED-AUDIT-2026-03-30.md
- macOS 800ms startup delay removed: An unconditional 800ms sleep designed for GTK splash window destruction was running on all platforms including macOS. Now gated behind #[cfg(target_os = "linux")]
- Linux localhost origin alignment: Production navigation and capabilities switched from localhost to 127.0.0.1 to avoid DNS resolver ambiguity. Capability remote URL updated to match
- tauri-plugin-localhost moved to Linux-only dependency: No longer compiled or linked on macOS/Windows builds, reducing binary size and eliminating unused code paths
- MEGA S4 signup URL: Corrected to mega.nz/register, help URL now points to S4 setup guide on docs.aeroftp.app
- Saved Servers scroll area: Increased visible height from calc(100vh-130px) to calc(100vh-80px), showing more servers without scrolling
- About dialog cleanup: Removed crypto diagnostics from Support tab, added Report Issue and Documentation links
Changed
- Jottacloud in supported_types(): Was missing from ProviderFactory::supported_types() despite being fully implemented and in the factory create() match. Now included
- FileLu S5 in ProvidersDialog: Added FileLu S5 Object Storage to provider feature matrix
- About dialog i18n: 3 new keys (reportIssue, documentation, openGithubIssue) translated in 47 languages
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[3.2.3] - 2026-03-30
Sigstore v0.3 Bundle Verification Fix
Fixed
- Sigstore updater fallback: The v3.2.1 fix for Sigstore bundle v0.3 format was incomplete. The actual error message from the sigstore crate is "unknown bundle profile application/vnd.dev.sigstore.bundle.v0.3+json" which was not matched by the previous fallback pattern. Auto-update from v3.2.1 was blocked by this error. Now correctly falls back to SHA-256 integrity verification when the bundle format is unrecognized.
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[3.2.2] - 2026-03-30
Advanced Share Links, MEGA S4 Object Storage & Security Hardening
New Features
- Advanced Share Link Options: Password protection, expiration, and permission controls for 13 providers. ShareLinkModal with capability-driven form (expiration presets, password field, view/edit/comment permissions). Backend ShareLinkOptions + ShareLinkResult structs with ShareLinkCapabilities trait method.
- Password support: Dropbox (Pro+), OneDrive (Personal), Box (paid), pCloud (Premium), Filen (Argon2id v3), Zoho WorkDrive, kDrive (paid), Drime Cloud, Nextcloud (auto-gen)
- Expiration support: 13 providers with provider-specific formats (ISO 8601, Unix timestamp, day count, Filen presets)
- Permission support: Google Drive (view/comment/edit), Dropbox, OneDrive, Box, Zoho, kDrive, Drime Cloud (view/edit)
- MEGA S4 Object Storage (new S3-compatible provider): Pre-configured preset with 4 regions (Amsterdam, Luxembourg, Montreal, Vancouver), virtual-hosted endpoints, presigned URLs. Full CRUD, multipart upload, share links verified via CLI stress test.
- CLI link command enhanced: --password, --expires (human-friendly: 1h/24h/7d/30d), --permissions flags. JSON output includes password and expires_at fields.
- Provider capability query: New Tauri command provider_share_link_capabilities exposes per-provider feature flags to frontend.
Fixed
- Google Drive share link: Removed expirationTime parameter for type: "anyone" permissions (silently ignored by Google API). Added commenter and writer role support.
- MEGAcmd "already exported" error: Auto-removes existing export and re-creates when share link already exists.
- MEGAcmd trash path traversal: Sanitized with Path::file_name() to prevent ../../ injection in restore and permanent delete operations.
- MEGA S4 capability gating: supports_versions() returns false, tagging operations return NotSupported, SSE/storage-class headers skipped, presigned URLs capped at 7 days.
- MEGA default connection tab: Now defaults to Native API (recommended) instead of MEGAcmd.
- MEGA connection texts: Updated from developer-facing ("path in rollout", "target path for the new connector") to user-facing language. Translated in 47 languages.
- Import MEGA Link dialog: Replaced browser window.prompt with themed InputDialog component.
- Nextcloud share link: Eliminated "url\npassword" string hack, now returns structured ShareLinkResult with separate password field.
- Session share link API: session_create_share_link now forwards password/expiration/permissions options.
- FileLu invoke type: Fixed incomplete type annotation for provider_create_share_link response.
- Share link icon resolution: Refactored from hardcoded switch to dynamic PROVIDER_LOGOS lookup with registry fallback, supporting all S3/WebDAV sub-providers.
i18n
- 13 new share link keys translated in 47 languages (generateDefault, showAdvanced, hideAdvanced, expiration, expirationNever, setPassword, passwordPlaceholder, passwordHint, permissions, perm_view, perm_comment, perm_edit, generateWithOptions)
- MEGA S4 provider keys (megaS4Desc, megaS4Tooltip)
- Updated S3 protocol description: "AWS S3, MEGA S4, R2, B2"
- Updated MEGA connection texts in 47 languages
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[3.1.8] - 2026-03-29
Desktop Security Hardening
Security
- Sigstore updater verification: In-app updates now verify .sigstore.json bundles against GitHub OIDC workflow identity before installing. Artifacts that fail verification are deleted automatically
- Linux update helper hardening: The privileged helper now receives SHA-256 from the backend and re-verifies integrity before executing dpkg/rpm, closing the TOCTOU gap
- AI backend approval system: All mutative AI tools require a cryptographic grant issued by the Rust backend and confirmed via native OS dialog. Grants are single-use (or session-scoped for non-destructive tools), expire after 2 min / 8 hours, and are bound to tool + session
- Plugin tools under approval: Plugin tools called by the AI now go through the same backend grant flow as built-in tools
- Vault keyring default: The vault passphrase is now stored in the OS credential manager (GNOME Keyring, macOS Keychain, Windows Credential Manager) instead of cleartext on disk. Legacy vaults are migrated automatically on first launch
- Keyring fallback: When the system keyring is unavailable on first launch, AeroFTP bootstraps into master password mode instead of failing
- Plugin registry disabled: Remote plugin fetch and install are disabled until the registry supports cryptographic authentication. Local plugins continue to work
- server_exec in NEVER_AUTO_APPROVE: Credential-backed server execution tool now always requires explicit approval, even in Extreme mode
Changed
- SECURITY.md restructured: Concise policy document with deep links to docs.aeroftp.app/security for full technical details
- Security documentation: 6 new pages on docs.aeroftp.app covering overview, AI security, supply chain, privacy, audits, and vulnerability disclosure
Fixed
- keyring crate mock backend: Fixed missing platform features in Cargo.toml that caused the keyring crate to compile with an in-memory mock backend on all platforms, which would have caused irrecoverable vault passphrase loss on app restart
- Nextcloud trash button: Restricted to Nextcloud/FeliCloud WebDAV providers only
- LargeIconsGrid performance: Virtualized with react-virtuoso for large directories
- DOMPurify CVE: Overridden to 3.3.3 (CVE mutation-XSS via monaco-editor)
- Clippy lint fixes: Resolved Cow<str>.as_ref() ambiguity in sync.rs and aeroftp_cli.rs triggered by sigstore dependency
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[3.1.7] - 2026-03-28
Glob Find & Production Polish
Fixed
- Find glob patterns: 8 providers (WebDAV, SFTP, S3, Jottacloud, Yandex Disk, GitHub, Filen, pCloud) now support glob patterns (*.txt, *.png) via globset. Previously only substring matching worked.
- MEGA find: Accept results even when mega-find exits with code 53.
- Blomp hidden in production: Blomp provider only visible in dev mode until storage proxy 403 is resolved.
Downloads:
- Windows: .msi installer, .exe, or .zip portable (no installation required)
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[3.1.5] - 2026-03-27
AeroAgent Hardening — APPENDIX-A Execution & Security Audit
Full execution of the AeroAgent evolution plan (APPENDIX-A): 6 areas implemented end-to-end, validated by independent security audit. 19 findings identified, 17 resolved — including 4 HIGH severity.
Added
- Prompt caching Anthropic: cache_control: { type: "ephemeral" } on system prompt, cache creation/read token metrics propagated to UI with cost savings display
- Tool result caching: Per-session in-memory cache with deterministic key (tool + args + context + remote_server), 3-tier TTL (3s/10s/20s), nuclear invalidation on mutations, lazy GC with 128-session LRU cap
- Structured transfer plans: New generate_transfer_plan tool with JSON schema, TransferPlanReview UI component with per-operation checkboxes, dependsOn dependency graph with topological execution and failure propagation across levels
- CLI/GUI parity & MCP hardening: Real tool-aware agent loop in CLI, MCP tools/list and tools/call derived from CLI dispatcher, recursive path validation, shared deny-list constants between CLI and MCP
- Agent memory SQLite: New agent_memory_db.rs backend with structured schema, store/search/delete commands, token-scored retrieval, 90-day lazy decay (6h interval, persisted), 500 entry-per-project cap, backend prompt injection sanitization, deduplication
- Voice input local: New speech.rs with whisper.cpp backend, on-demand model download with SHA-256 integrity verification, WAV mono 16kHz validation, local audio recording, 3-state UX (idle/listening/transcribing), non-blocking transcription
Changed
- Tool pipeline failure propagation: Pipeline now tracks failed tools and skips dependents with transitive propagation — no more cascading errors when a prerequisite fails
- Tool approval cache scoping: ToolApproval and BatchToolApproval now forward sessionId for correct cache isolation
- Cache key includes remote server context: Cache key disambiguated by active server connection, preventing cross-server result leakage
- Public documentation synchronized with validated behavior: CLI, AeroAgent, GitHub integration, and credential-isolation docs now avoid stale command/protocol counts, clarify profile-backed provider support (including 4shared and Drime), document provider-dependent quota reporting, and align GitHub commit semantics with current REST + GraphQL behavior
- Appendix-C CLI closure documented with final FTP/FTPS outcome: Added final closure dossier covering C1-C4 status, multi-provider audit conclusions, and the final FTP/FTPS alignment between GUI and CLI
Fixed
- macOS frozen UI on launch: Removed App Sandbox from entitlements.plist for direct distribution — without Apple Developer signature, sandbox blocks WebKit from loading frontend. Added missing JIT and library validation entitlements required for WebKit. Closes #62
- CLI shell_execute meta-char bypass: Added shell metacharacter blocking (pipe, semicolon, backtick, $, &, parens, braces, newlines) to CLI shell execution, closing trivial deny-list bypass via pipes or subshells
- CLI shell_execute working directory not validated: Now validates working directory against deny-list before use — prevents operating in sensitive directories
- CLI shell_execute deny-list expanded: Extended from 17 to 39 patterns (added sudo, crontab, systemctl, mount, fdisk, passwd, eval, shred, etc.)
- CLI local_trash/batch_rename/stat_batch path validation: All three tools now validate each individual path, closing deny-list bypass via MCP
- MCP argument validation incomplete: Added output_path, path_a, path_b, project_path to validated parameters, plus recursive validation of nested JSON structures
- Deny-list discrepancy CLI vs MCP: Unified into shared constants
- Agent memory unlimited storage: Capped at 500 entries per project with capacity enforcement before INSERT
- Agent memory prompt injection via CLI: Backend sanitization applied before SQL INSERT, not just in frontend
- Whisper model download without integrity

[3.1.3] - 2026-03-26
AeroCloud Hardening — Production-Grade Sync Engine
Comprehensive AeroCloud sync overhaul: 6-phase sprint covering engine hardening, protocol fixes (OpenDrive, FileLu, 4shared), selective sync, file versioning, and .aeroignore support. Audited by 5 parallel Opus 4.6 agents — 10 findings identified and resolved.
Added
- Selective sync: Exclude remote folders from sync via tree-view checkbox UI in CloudPanel settings. Backend skips excluded folders in both scan and comparison phases. New SelectiveSyncTree component with collapse/expand, parent cascade, and dirty-state tracking
- File versioning (.aeroversions/): Automatic backup of overwritten/deleted files during sync. Three strategies — TrashCan (cleanup after N days), Simple (keep last N copies), Staggered (1/hour for 24h, 1/day for 30d, 1/week older). New VersionBrowser component with restore, cleanup, and disk usage display
- .aeroignore file: Gitignore-compatible pattern exclusion in sync root. Supports */** globs, ! negation (re-include), # comments, directory-only trailing /. Default template created on setup. Applied to all 3 scan paths (local, FTP remote, provider remote)
- Protocol maturity badges: Stable/Beta/Alpha classification for all 21 AeroCloud protocols in setup wizard, dashboard, and wizard preview. Tooltip with one-line limitation per protocol
- Re-authorization banner: Token revocation detection for OAuth 1.0a providers (4shared) — red banner with "Re-authorize" button in CloudPanel, triggered via cloud-reauth-required Tauri event
- FileLu content hash: hash field captured from FileLu API responses, propagated as content_hash metadata for hash-based sync comparison (no mtime modification of local files)
- Tauri commands: update_excluded_folders, list_remote_folders_tree, list_file_versions, restore_file_version, cleanup_versions, versions_disk_usage
Changed
- Conflict naming: Dropbox-style format report (AeroCloud conflict 2026-03-26 14-30-22 hostname).pdf replaces report_conflict_20260326143052.pdf. Includes machine hostname for multi-device disambiguation
- Timestamp fallback: Size-only comparison when file timestamps are absent (providers like FileLu). timestamps_equal(None, None) now returns true. Sync index comparison falls back to size-only when cached mtime is None. Prevents infinite re-sync loops
- OpenDrive session management: Proactive session refresh at 50-minute threshold via ensure_session(). Automatic re-authentication on 401 with single retry in list(). last_activity tracking across all operations (list, cd, download, upload, mkdir, delete, rename)
- 4shared auth hardening: check_auth_status() applied to all 4 HTTP methods (GET, POST, DELETE, PUT). 401 responses produce AuthenticationFailed("4shared_token_revoked: ...") — sync loop aborts and emits frontend event
- Default exclude patterns: .aeroignore and .aeroversions added to default exclude_patterns in CloudConfig
- File watcher: .aeroversions added to EXCLUDED_HIDDEN list to prevent watcher events from versioning directory
Fixed
- FTP download versioning: Archive hook was missing in FTP sync path — local files were overwritten without backup. Now both FTP and provider paths archive before download (SEC audit finding #7)
- Version restore safety: restore() now archives the current file before overwriting, preventing data loss on restore operations (audit finding #10)
- Restore path traversal: restore_file_version command validates archive_path is within .aeroversions/ and rejects .. traversal (SEC audit finding #8)
- Local scan excluded_folders: scan_local_folder() now skips directories listed in excluded_folders, preventing unwanted uploads of excluded content (audit finding #9)
- OpenDrive operations coverage: ensure_session() added to download_to_bytes, mkdir, delete, rmdir_recursive, rename — previously only list/cd/download/upload were covered (audit findings #1-3)
- 4shared PUT auth check: signed_put_form now calls check_auth_status() — previously 401 on rename/m

[3.1.2] - 2026-03-25
Zoho WorkDrive — Full MCP Parity & Native Document Support
Complete Zoho WorkDrive integration upgrade: all 22 MCP tools covered, native Zoho document creation and auto-conversion, share link management UI, and enhanced OAuth scopes.
Added
- Zoho getUserInfo: New zoho_get_user_info command returning display name, email, ZUID, team ID, and team name
- Zoho getFileShareLinks: New zoho_get_file_share_links command listing all external share links for a file/folder with full attributes (URL, type, expiration, password protection)
- Zoho deleteShareLink: New zoho_delete_share_link command to revoke external share links by ID
- Zoho createNativeDocument: New zoho_create_native_document command to create Zoho Writer, Sheet, and Show documents directly in WorkDrive
- Zoho native doc export: Download auto-converts native Zoho documents to Office formats (.docx, .xlsx, .pptx) with correct file extension
- Manage Share Links dialog: Dark-themed modal listing all share links with one-click copy and delete, accessible via right-click context menu on Zoho WorkDrive files
- New Document context menu: Right-click empty area shows "Zoho Writer", "Zoho Sheet", "Zoho Show" options with themed InputDialog for document name
- Share link session tracking: Deleted link IDs tracked per-session to filter Zoho GET cache returning stale entries
- 7 new i18n keys: manageShareLinks, noShareLinks, noShareLinksDesc, shareLinksFor, deleteShareLinkPrompt, shareLinkDeleted, newDocumentName — translated to all 46 languages
Changed
- OAuth scope upgrade: WorkDrive.links.CREATE + WorkDrive.links.READ replaced with WorkDrive.links.ALL to enable link deletion
- Native doc detection: File listing metadata now includes file_type, extn, isZohoNativeDoc, exportFormat, and exportExtension for Zoho native documents
- Swap Panels: New option in Settings > UI > Interface to swap Local and Remote panel positions, plus a quick-flip button in the toolbar. Places local panel on the left and remote on the right, matching the classic FTP client layout. Default remains Remote (left) / Local (right). Persisted in vault/localStorage, applies instantly without restart. Resolves #61
Downloads:
- Windows: .msi installer or .exe
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[3.1.1] - 2026-03-24
GitHub Integration Hardening & Settings Overhaul
Enterprise-grade security audit remediation (5 independent auditors: 4x Claude Opus 4.6 + GPT 5.4), GitHub provider performance upgrades, Settings panel modularization, and AeroCloud full configuration.
Added
- GitHub Settings edit form: 3-mode auth selector (OAuth / PAT / App .pem) with per-mode fields replaces generic Host/Port form when editing GitHub servers
- GitHub auth mode badges: Colored APP (purple), PAT (amber), OAuth (blue) badges in Settings server list, matching connection screen
- GitHub release asset upload UI: "Upload Asset" button in Release Browser with file dialog and auto-refresh
- GitHub Pages configuration editor: Edit source branch, path, and CNAME directly from Pages Browser via github_update_pages
- GitHub Pages DNS health check: One-click DNS health verification for custom domains
- GitHub Actions live status indicator: Toolbar button changes green (idle) to amber + pulsing dot (running), polled every 60s
- GitHub official octicons: Actions (octicon-play) and Releases (octicon-tag) icons replace generic Lucide icons
- AeroCloud dedicated Settings tab: Full configuration panel extracted from OAuth Providers tab with all options: cloud name, remote folder, sync interval, sync on change, sync on startup, conflict strategy (5 modes), exclude patterns editor, public URL, SyncScheduler, WatcherStatus, enable/disable toggle, sync now, badge integration
- OAuth Providers tab: Renamed from "Cloud Providers", GitHub card added with "No API keys needed" badge
- Rate limit retry with backoff: execute_with_retry() for secondary rate limits (sleep + retry) and 5xx (1s delay), wired to all high-level client methods
- 40 new i18n keys: GitHub settings (13) + AeroCloud settings (17) + GitHub UI (10), propagated to all 47 languages
Fixed
- GitHub App token no longer crosses IPC: Installation token held in Rust ProviderState, injected only for App auth mode. Frontend never sees the raw token (SEC-GH-1)
- Local git command hardening: github_check_local_sync and github_push_local now validate paths (canonicalize + is_dir + .git check), verify repo remote matches connected owner/repo with boundary detection, use async tokio::process::Command with GIT_TERMINAL_PROMPT=0 (SEC-GH-2/003)
- XSS in release body preview: HTML entities escaped before Markdown regex conversion (FT-GH-8)
- URL domain allowlist: resolve_url() rejects non-GitHub domains, pagination Link URLs validated. http:// rejected entirely (SEC-GH-4/005)
- Streaming download: StorageProvider::download() streams to disk via bytes_stream() + AtomicFile instead of buffering entire file (QA-GH-2)
- Upload memory reduction: drop(data) after base64 encode, protected-branch retry mutates body in-place instead of cloning (QA-GH-3/019)
- Non-panicking HTTP client: GitHubHttpClient::new() returns Result instead of .expect() panic (QA-GH-4)
- Structured error matching: Protected-branch fallback uses GitHubError enum matching instead of string contains() (QA-GH-9)
- 5xx explicit classification: classify_api_error() maps 500-599 to ServerError instead of generic catch-all (API-GH-4)
- User-Agent auto-versioned: Derived from CARGO_PKG_VERSION at build time, no longer stale (QA-GH-13)
- Duplicate i18n key removed: github.commitFiles appeared twice in en.json (FT-GH-6)
- GitHub batch upload for single files: Threshold changed from >1 to >=1, all uploads use atomic GraphQL commit
- GitHub atomic batch delete: Multi-file delete now uses github_batch_delete (was sequential)
- Pre-push check on every upload: Removed once-per-session guard, checks for unpushed commits before every upload
Changed
- Settings panel modularization: AeroCloud extracted to SettingsAeroCloudTab component in src/components/settings/
- 4-theme CSS migration: 5 GitHub modal containers + 2 inner elements migrated from Tailwind bg-white dark:bg-gray-800 to var(--color-bg-secondary) for Tokyo Night and Cyber support
- Dead code cleanup: Identic

[3.1.0] - 2026-03-23
Co-Author Address Book & Static CRT
Added
- Co-Author address book: Persistent contact list in GitHub commit dialog, add usernames or app[bot] names, toggle on/off per commit. Saved co-authors appear as colored chips with one-click enable/disable. Enabled co-authors automatically append Co-Authored-By trailers to commit messages. Works with all 3 GitHub connection methods (OAuth, PAT, PEM)
Fixed
- Windows static CRT linking: Added .cargo/config.toml with +crt-static for x86_64-pc-windows-msvc target. The CLI binary (aeroftp-cli) no longer requires vcruntime140.dll at runtime, resolving STATUS_DLL_NOT_FOUND (0xC0000135) on clean Windows installs and in the winget validation sandbox
- README CLI binary name: Corrected aeroftp references to aeroftp-cli in CLI usage examples
Downloads:
- Windows: .msi installer or .exe
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage

[3.0.0] - 2026-03-17
GitHub Integration — 23rd Protocol, Custom Commit Identity & Developer Program
AeroFTP enters GitHub. Browse repositories as filesystems, upload files that become commits, manage release assets, and customize your commit identity with your own GitHub App logo. The first file transfer client with native GitHub API integration across GUI, CLI, and AI agents.
Added
- GitHub as 23rd protocol: Full repository filesystem — browse, upload (commit), download, delete (commit), rename, mkdir, search, tree. Every write operation creates a real Git commit
- Three authentication modes: Authorize with GitHub (Device Flow one-click), Personal Access Token (manual), GitHub App with .pem (bot mode with custom logo in commits)
- Custom commit identity: Create your own GitHub App with your logo — commits show your app's name and avatar in the repository's contributor list. Same mechanism used by GitHub Actions and Dependabot
- Release asset management: Releases as virtual directories (.github-releases/), asset upload as raw binary (up to 2 GiB), download, delete
- Branch awareness: Direct push on writable branches, automatic working branch (aeroftp/{user}/{base}) for protected branches, read-only mode detection. Write mode indicator in status bar
- GitHub-specific GUI: Branch selector dropdown in toolbar, write mode indicator, commit message dialog for uploads/deletes, batch commit prompt (single message for multi-file operations), branch protection info box
- Context menu: "View on GitHub", "Copy Raw URL", "File History" with working branch awareness
- Protocol selector reorganized: "Protocols" section (FTP, SFTP, WebDAV, S3, Azure) + "Services" section (GitHub first, then cloud providers)
- AeroCloud dynamic button: Cloud icon with green LED in Quick Connect header — opens AeroCloud if configured, setup wizard if not
- GitHub App created: github.com/apps/aeroftp — official AeroFTP GitHub App for Device Flow authorization
- GitHub provider documentation: docs/GITHUB-INTEGRATION.md — comprehensive guide for all three auth modes, custom identity, and technical details
- 47 new i18n keys: GitHub auth, commit dialog, branch selector, write mode, protection info — translated in all 47 languages
- CLI github:// URL scheme: aeroftp ls github://token@owner/repo /path/
- CLI --profile for GitHub: Connect to saved GitHub repos without exposing tokens
- agent-info command: Structured JSON capability discovery for AI agents, includes GitHub in supported protocols
- AGENTS.md: Complete integration guide for AI coding agents with GitHub workflows
Fixed
- FTP/TLS upload truncation (critical): Files >8KB silently truncated. Fix: flush + drain delay before TLS close_notify
- WebDAV HTTP upload 0 bytes (critical): Streaming with Content-Length header
- WebDAV OOM on large files: Stream from file instead of reading into memory
- CLI shell injection: Archive tools now use Command::new with .arg(), no sh -c
- CLI symlink escape: verify_path_within_root() prevents symlink-based directory escape in recursive downloads
- CLI profile disambiguation: Exact match priority, ambiguous matches show candidates
- Master password hidden input: rpassword instead of visible stdin.read_line()
- Partial download cleanup: Failed downloads remove partial file
- kDrive CLI mapping: Added missing protocol mapping
- Path encoding fix: GitHub Contents API URLs encode segments individually, not slashes
- Installation token permissions: Override push:false bug in GitHub API for bot tokens
Security (Dual 10-auditor review: Claude Opus 4.6 + GPT 5.4)
- 83+ findings from 5 Claude auditors (security, performance, UX, Rust quality, OAuth)
- 7 findings from GPT 5.4 full integration review (4 HIGH, 3 MEDIUM — all resolved)
- Shell injection eliminated, symlink escape protection, token detection hardened
- .pem private key read in Rust backend only — path crosses IPC, never key content
- Committer identity conditional: bot for installation tokens, user identity for PAT/Device

[2.9.2] - 2026-03-10
CLI Expansion, AI Core Refactor & AeroVault OS Integration
Production-ready CLI with batch scripting engine, backend-agnostic AI architecture for future CLI agent mode, cross-platform .aerovault file association, and Snap Store compliance fix.
Added
- AeroFTP CLI expansion: 14 commands (connect, ls, get, put, mkdir, rm, mv, cat, find, stat, df, tree, sync, batch) across 12 protocols with full --json output, glob pattern transfers, batch scripting engine, and progress bars
- CLI batch scripting: .aeroftp script files with variable substitution (${VAR}), $ escaping ($$), error policies (ON_ERROR CONTINUE/FAIL), and 17 batch commands
- CLI tree command: Recursive directory tree with Unicode box-drawing, BFS depth limit, cycle detection, and JSON output
- CLI glob uploads: Pattern-based multi-file uploads (e.g., aeroftp put sftp://host "*.csv") via globset crate
- CLI documentation: Comprehensive CLI Guide with usage examples, batch scripting reference, and CI/CD integration patterns
- AI Core abstraction layer: EventSink, CredentialProvider, RemoteBackend traits decoupling AI streaming from Tauri — foundation for CLI agent mode
- AeroVault MIME type icon: Custom shield+lock icon in 8 PNG sizes (16-512px) + SVG + ICO + ICNS for all platforms
- AeroVault file association: Double-click .aerovault files to open directly in AeroFTP (Linux .deb, Snap, Windows NSIS, macOS)
- Deep-link handler: Single-instance argv forwarding and first-launch file open with path validation
Fixed
- CLI security audit (45 findings): Path traversal prevention, ANSI escape sanitization, BFS cycle detection, OOM protection (256 MB cat limit, 500K entry scan limit), NO_COLOR compliance, stdout/stderr separation
- CLI batch engine hardening: SET value limit (64 KB), variable count cap (256), 1 MB file limit, injection-safe single-pass expansion
- Snap Store compliance: Softened description removing flagged keywords (scripting, execution, shell commands, rm) to pass metadata-snap-v2_snap_metadata_redflag automated review
- API key sanitization: sanitize_error_message() upgraded with 5 LazyLock regex patterns for Anthropic/OpenAI keys, Bearer tokens, x-api-key headers
Changed
- AI streaming refactored: ai_chat_stream_with_sink() replaces direct app.emit() calls — all stream functions now accept &dyn EventSink
- VaultIcon unified: Shield+lock design matching OS MIME icon replaces old safe/vault icon across frontend (modal, context menus, icon themes)
Downloads:
- Windows: .msi installer or .exe
- macOS: .dmg disk image
- Linux: .deb, .rpm, .snap, or .AppImage